9.1

CVE-2024-22131

In SAP ABA (Application Basis) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75I, an attacker authenticated as a user with a remote execution authorization can use a vulnerable interface. This allows the attacker to use the interface to invoke an application function to perform actions which they would not normally be permitted to perform.  Depending on the function executed, the attack can read or modify any user/business data and can make the entire system unavailable.

Data is provided by the National Vulnerability Database (NVD)
SAP ≫ Abap Platform Version75c
SAP ≫ Abap Platform Version75i
SAP ≫ Abap Platform Version700
SAP ≫ Abap Platform Version701
SAP ≫ Abap Platform Version702
SAP ≫ Abap Platform Version731
SAP ≫ Abap Platform Version740
SAP ≫ Abap Platform Version750
SAP ≫ Abap Platform Version751
SAP ≫ Abap Platform Version752
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 4.46% 0.886
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
cna@sap.com 9.1 2.3 6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

https://me.sap.com/notes/3420923
Permissions Required