CVE-2024-22131

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-22131
In SAP ABA (Application Basis) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75I, an attacker authenticated as a user with a remote execution authorization can use a vulnerable interface. This allows the attacker to use the interface to invoke an application function to perform actions which they would not normally be permitted to perform.  Depending on the function executed, the attack can read or modify any user/business data and can make the entire system unavailable.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://me.sap.com/notes/3420923 Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory
https://me.sap.com/notes/3420923 Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:abap_platform:75c:*:*:*:*:*:*:*
cpe:2.3:a:sap:abap_platform:75i:*:*:*:*:*:*:*
cpe:2.3:a:sap:abap_platform:700:*:*:*:*:*:*:*
cpe:2.3:a:sap:abap_platform:701:*:*:*:*:*:*:*
cpe:2.3:a:sap:abap_platform:702:*:*:*:*:*:*:*
cpe:2.3:a:sap:abap_platform:731:*:*:*:*:*:*:*
cpe:2.3:a:sap:abap_platform:740:*:*:*:*:*:*:*
cpe:2.3:a:sap:abap_platform:750:*:*:*:*:*:*:*
cpe:2.3:a:sap:abap_platform:751:*:*:*:*:*:*:*
cpe:2.3:a:sap:abap_platform:752:*:*:*:*:*:*:*
History

21 Nov 2024, 08:55

Type Values Removed Values Added
References () https://me.sap.com/notes/3420923 - Permissions Required () https://me.sap.com/notes/3420923 - Permissions Required
References () https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory () https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory
CVSS v2 : unknown
v3 : 7.2 		v2 : unknown
v3 : 9.1

16 Oct 2024, 21:28

Type Values Removed Values Added
First Time Sap abap Platform
Sap
CPE cpe:2.3:a:sap:abap_platform:702:*:*:*:*:*:*:*
cpe:2.3:a:sap:abap_platform:750:*:*:*:*:*:*:*
cpe:2.3:a:sap:abap_platform:731:*:*:*:*:*:*:*
cpe:2.3:a:sap:abap_platform:700:*:*:*:*:*:*:*
cpe:2.3:a:sap:abap_platform:740:*:*:*:*:*:*:*
cpe:2.3:a:sap:abap_platform:75i:*:*:*:*:*:*:*
cpe:2.3:a:sap:abap_platform:752:*:*:*:*:*:*:*
cpe:2.3:a:sap:abap_platform:751:*:*:*:*:*:*:*
cpe:2.3:a:sap:abap_platform:701:*:*:*:*:*:*:*
cpe:2.3:a:sap:abap_platform:75c:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 9.1 		v2 : unknown
v3 : 7.2
References () https://me.sap.com/notes/3420923 - () https://me.sap.com/notes/3420923 - Permissions Required
References () https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - () https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory

13 Feb 2024, 14:01

Type Values Removed Values Added
Summary
  • (es) En SAP ABA (Application Basis), versiones 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75I, un atacante autenticado como usuario con autorización de ejecución remota puede utilizar una interfaz vulnerable. Esto permite al atacante utilizar la interfaz para invocar una función de la aplicación para realizar acciones que normalmente no se le permitiría realizar. Dependiendo de la función ejecutada, el ataque puede leer o modificar cualquier dato de usuario/empresa y puede hacer que todo el sistema no esté disponible.

13 Feb 2024, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-13 03:15

Updated : 2024-11-21 08:55

NVD link : CVE-2024-22131

Mitre link : CVE-2024-22131

CVE.ORG link : CVE-2024-22131

JSON object : View

Products Affected

sap

  • abap_platform
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')