Multiple SAP Products Vulnerabilities

September 12, 2024

Severity

Medium

Analysis Summary

CVE-2024-45284 CVSS:2.4

SAP Student Life Cycle Management could allow a remote authenticated attacker to gain elevated privileges on the system, caused by a improper authorization validation. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges.

CVE-2024-45283 CVSS:6

SAP NetWeaver AS for Java could allow a local authenticated attacker to obtain sensitive information, caused by a flaw when creating an RFC destination. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain username and password information, and use this information to launch further attacks against the affected system.

CVE-2024-42371 CVSS:5.4

SAP NetWeaver Application Server for ABAP and ABAP Platform could allow a remote authenticated attacker to bypass security restrictions, caused by improper authorization validation by the RFC enabled function module. By sending a specially crafted request, an attacker could exploit this vulnerability to delete the workplace favourites of any user.

CVE-2024-44115 CVSS:4.3

CVE-2024-44117 CVSS:5.4

CVE-2024-42380 CVSS:4.3

SAP NetWeaver Application Server for ABAP and ABAP Platform could allow a remote authenticated attacker to obtain sensitive information, caused by improper authorization validation by the RFC enabled function module. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to read any user's workplace favourites and user menu along with all the specific data of each node, and use this information to launch further attacks against the affected system.

CVE-2024-45279 CVSS:6.1

SAP NetWeaver Application Server for ABAP is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

CVE-2024-45280 CVSS:4.8

SAP NetWeaver AS Java is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability using a specially crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

CVE-2024-44114 CVSS:2

SAP NetWeaver Application Server for ABAP and ABAP Platform could allow a remote authenticated attacker to obtain sensitive information, caused by improper authorization validation. By executing a specially crafted program, an attacker could exploit this vulnerability to obtain data over the network, and use this information to launch further attacks against the affected system.

CVE-2024-44112 CVSS:4.3

SAP for Oil & Gas could allow a remote authenticated attacker to bypass security restrictions, caused by improper authorization validation. By sending a specially crafted request, an attacker could exploit this vulnerability to delete non-sensitive entries in a user data table.

CVE-2024-44121 CVSS:4.3

SAP S/4 HANA could allow a remote authenticated attacker to obtain sensitive information, caused by an incompatible policies flaw. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain internal user data, and use this information to launch further attacks against the affected system.

CVE-2024-44120 CVSS:4.7

SAP NetWeaver Enterprise Portal is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

CVE-2024-44113 CVSS:4.3

SAP Business Warehouse could allow a remote authenticated attacker to obtain sensitive information, caused by improper authorization valuation. By sending a specially crafted request, an attacker could exploit this vulnerability to access information over the network, and use this information to launch further attacks against the affected system.

CVE-2024-45285 CVSS:5.4

CVE-2024-41729 CVSS:4.3

SAP NetWeaver BW could allow a remote authenticated attacker to obtain sensitive information, caused by improper authorization validation. By sending a specially crafted request, an attacker could exploit this vulnerability to access information over the network, and use this information to launch further attacks against the affected system.

CVE-2024-41728 CVSS:2.7

SAP NetWeaver Application Server for ABAP and ABAP Platform could allow a remote authenticated attacker to obtain sensitive information, caused by improper authorization validation. By sending a specially crafted request, an attacker could exploit this vulnerability to read objects contained in a package, and use this information to launch further attacks against the affected system.

CVE-2024-45281 CVSS:5.8

SAP BusinessObjects Business Intelligence Platform could allow a local authenticated attacker to execute arbitrary code on the system, caused by improper loading of Dynamic Link Libraries in the installer. By persuading a victim to open a specially crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2024-44116 CVSS:4.3

CVE-2024-42378 CVSS:6.1

SAP S/4HANA eProcurement is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

CVE-2024-45286 CVSS:6.5

SAP Production and Revenue Accounting could allow a remote authenticated attacker to obtain sensitive information, caused by improper authorization validation. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.

Impact