CVE-2024-24743

XXE vulnerability in SAP NetWeaver AS Java (Guided Procedures)

CVSS 8.6 HIGHEPSS 0.5%CWE-611

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.6EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

13 Feb 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which when parsed will enable him to access sensitive files and data but not modify them. There are expansion limits in place so that availability is not affected.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Affected products

SAP_SE · SAP NetWeaver AS Java (Guided Procedures)

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://me.sap.com/notes/3426111 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html