CVE-2024-22127

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-22127

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

S

AP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands which can cause high impact on confidentiality, integrity and availability of the application.

References
Link Resource
https://me.sap.com/notes/3433192 Permissions Required
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 Vendor Advisory
https://me.sap.com/notes/3433192 Permissions Required
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:netweaver_application_server_java:7.5:*:*:*:*:*:*:*
History

07 Feb 2025, 17:25

Type Values Removed Values Added
CPE cpe:2.3:a:sap:netweaver_application_server_java:7.5:*:*:*:*:*:*:*
First Time Sap
Sap netweaver Application Server Java
References () https://me.sap.com/notes/3433192 - () https://me.sap.com/notes/3433192 - Permissions Required
References () https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 - () https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 - Vendor Advisory

21 Nov 2024, 08:55

Type Values Removed Values Added
References () https://me.sap.com/notes/3433192 - () https://me.sap.com/notes/3433192 -
References () https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 - () https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 -

26 Sep 2024, 19:15

Type Values Removed Values Added
CWE CWE-94 CWE-77
Summary (en) SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands which can cause high impact on confidentiality, integrity and availability of the application. (en) SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands which can cause high impact on confidentiality, integrity and availability of the application.
Information

Published : 2024-03-12 01:15

Updated : 2025-02-07 17:25

NVD link : CVE-2024-22127

Mitre link : CVE-2024-22127

CVE.ORG link : CVE-2024-22127

JSON object : View

Products Affected

sap

CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')