by Kastro
Paper/Archive/CVE-2024-22127

CVE-2024-22127

SAP_SE SAP NetWeaver AS Java (Administrator Log Viewer plug-in) — Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in)

EPSS 2%CVSS 9.1
critical.is priorityof 100
42
CVSS 9.1 (CNA, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 75.7.757 × 2015.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands which can cause high impact on confidentiality, integrity and availability of the application.

Affected

ProductAffectedFixed inSource
SAP NetWeaver AS Java (Administrator Log Viewer plug-in)7.50–CNA
netweaver7.50–CISA-ADP

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
sap (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refme.sap.com/notes/3433192refsupport.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364