by Kastro
Paper/Archive/CVE-2024-21737

CVE-2024-21737

SAP_SE SAP Application Interface Framework (File Adapter) — Code Injection vulnerability in SAP Application Interface Framework (File Adapter)

EPSS 0.6%CVSS 9.1
critical.is priorityof 100
37
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 49.3.493 × 209.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In SAP Application Interface Framework File Adapter - version 702, a high privilege user can use a function module to traverse through various layers and execute OS commands directly. By this, such user can control the behaviour of the application. This leads to considerable impact on confidentiality, integrity and availability.

Affected

ProductAffectedFixed inSource
SAP Application Interface Framework (File Adapter)702–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
sap (CNA)8.4CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refme.sap.com/notes/3411869refsap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html