Sap Basis
CVE-2024-39599
MEDIUM
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Primary rating from Vendor (sap) · only source for this CVE.
CVSS VectorVendor: sap
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured malware scanner API because of a programming error. This leads to a low impact on the application's confidentiality, integrity, and availability.
AnalysisAI
Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured malware scanner API because of a programming error. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity.
Technical ContextAI
This vulnerability is classified under CWE-693. Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured malware scanner API because of a programming error. This leads to a low impact on the application's confidentiality, integrity, and availability. Affected products include: Sap Sap Basis.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting
The (1) SAP_BASIS and (2) SAP_ABA components 7.00 SP Level 0031 in SAP NetWeaver 2004s might allow remote attackers to s
Sap Basis versions up to 700 is affected by url redirection to untrusted site (open redirect) (CVSS 6.5).
SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to create a malicious link wh
SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respon
Under certain conditions SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to access remote
SAP Business Workflow contains an authorization bypass that allows authenticated administrators to escalate privileges b
WebFlow Services of SAP Business Workflow allows an authenticated attacker to enumerate accessible HTTP endpoints in the
Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privi
SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauth
SAP NetWeaver (Service Data Download) allows an authenticated user to call a remote-enabled function module, which could
The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations fo
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today