CVE-2024-34683

Unrestricted file upload in SAP Document Builder (HTTP service)

CVSS 6.5 MEDIUMEPSS 0.2%CWE-434

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 6.5EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

11 Jun 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

An authenticated attacker can upload malicious file to SAP Document Builder service. When the victim accesses this file, the attacker is allowed to access, modify, or make the related information unavailable in the victim’s browser.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Affected products

SAP_SE · SAP Document Builder

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://me.sap.com/notes/3459379 https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html