CERTFR-2024-AVI-0554
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et une injection de code indirecte à distance (XSS).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
SAP N/A Enable Now versions antérieures à WPB_MANAGER_HANA 10 sans le dernier correctif de sécurité
SAP N/A Business Workflow (WebFlow Services) versions antérieures à SAP_BASIS 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de sécurité
SAP N/A Enable Now versions antérieures à WPB_MANAGER_CE 10 sans le dernier correctif de sécurité
SAP N/A Business Warehouse - Business Planning and Simulation versions antérieures à SAP_BW 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 sans le dernier correctif de sécurité
SAP N/A Commerce versions antérieures à HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité
SAP N/A Enable Now versions antérieures à ENABLE_NOW_CONSUMP_DEL 1704 sans le dernier correctif de sécurité
SAP N/A CRM WebClient UI versions antérieures à S4FND 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité WEBCUIF 701, 731, 746, 747, 748, 800, 801
SAP N/A CRM WebClient UI versions antérieures à S4FND 104 sans le dernier correctif de sécurité
SAP N/A PDCE versions antérieures à S4CORE 102 et 103 sans le dernier correctif de sécurité
SAP N/A Business Warehouse - Business Planning and Simulation versions antérieures à SAP_BW_VIRTUAL_COMP 701 sans le dernier correctif de sécurité
SAP N/A S/4HANA Finance (Advanced Payment Management) versions antérieures à S4CORE 107 et 108 sans le dernier correctif de sécurité
SAP N/A NetWeaver Application Server for ABAP and ABAP Platform versions antérieures à SAP_BASIS 700,701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 795 et 796 sans le dernier correctif de sécurité
SAP N/A GUI pour Windows versions antérieures à BC-FES-GUI 8 sans le dernier correctif de sécurité
SAP N/A NetWeaver Knowledge Management XMLEditor versions antérieures à KMC-WPC 7.50 sans le dernier correctif de sécurité
SAP N/A CRM WebClient UI versions antérieures à WEBCUIF 701, 731, 746, 747, 748, 800, 801 sans le dernier correctif de sécurité
SAP N/A PDCE versions antérieures à S4COREOP 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité
References
Bulletin de sécurité SAP 2024-07-08 vendor-advisory

Show details on source website


{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Enable Now versions ant\u00e9rieures \u00e0 WPB_MANAGER_HANA 10 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Business Workflow (WebFlow Services) versions ant\u00e9rieures \u00e0 SAP_BASIS 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Enable Now versions ant\u00e9rieures \u00e0 WPB_MANAGER_CE 10 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Business Warehouse - Business Planning and Simulation versions ant\u00e9rieures \u00e0 SAP_BW 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Commerce versions ant\u00e9rieures \u00e0 HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Enable Now versions ant\u00e9rieures \u00e0 ENABLE_NOW_CONSUMP_DEL 1704 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "CRM WebClient UI versions ant\u00e9rieures \u00e0 S4FND 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9 WEBCUIF 701, 731, 746, 747, 748, 800, 801",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "CRM WebClient UI versions ant\u00e9rieures \u00e0 S4FND 104 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "PDCE versions ant\u00e9rieures \u00e0 S4CORE 102 et 103 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Business Warehouse - Business Planning and Simulation versions ant\u00e9rieures \u00e0 SAP_BW_VIRTUAL_COMP 701 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "S/4HANA Finance (Advanced Payment Management) versions ant\u00e9rieures \u00e0 S4CORE 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Application Server for ABAP and ABAP Platform versions ant\u00e9rieures \u00e0 SAP_BASIS 700,701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 795 et 796 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "GUI pour Windows versions ant\u00e9rieures \u00e0 BC-FES-GUI 8 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Knowledge Management XMLEditor versions ant\u00e9rieures \u00e0 KMC-WPC 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "CRM WebClient UI versions ant\u00e9rieures \u00e0 WEBCUIF 701, 731, 746, 747, 748, 800, 801 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "PDCE versions ant\u00e9rieures \u00e0 S4COREOP 104, 105,\n106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-34689",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-34689"
    },
    {
      "name": "CVE-2024-37174",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-37174"
    },
    {
      "name": "CVE-2024-39597",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39597"
    },
    {
      "name": "CVE-2024-37171",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-37171"
    },
    {
      "name": "CVE-2024-37172",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-37172"
    },
    {
      "name": "CVE-2024-34685",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-34685"
    },
    {
      "name": "CVE-2024-39596",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39596"
    },
    {
      "name": "CVE-2024-34683",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-34683"
    },
    {
      "name": "CVE-2024-37180",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-37180"
    },
    {
      "name": "CVE-2024-39600",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39600"
    },
    {
      "name": "CVE-2024-37175",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-37175"
    },
    {
      "name": "CVE-2024-39594",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39594"
    },
    {
      "name": "CVE-2024-37173",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-37173"
    },
    {
      "name": "CVE-2024-39599",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39599"
    },
    {
      "name": "CVE-2024-39598",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39598"
    },
    {
      "name": "CVE-2024-39593",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39593"
    },
    {
      "name": "CVE-2024-39592",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39592"
    },
    {
      "name": "CVE-2024-34692",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-34692"
    },
    {
      "name": "CVE-2024-39595",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39595"
    }
  ],
  "initial_release_date": "2024-07-09T00:00:00",
  "last_revision_date": "2024-07-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0554",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-07-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
  "vendor_advisories": [
    {
      "published_at": "2024-07-08",
      "title": "Bulletin de s\u00e9curit\u00e9 SAP",
      "url": "https://support.sap.com/content/dam/support/en_us/library/ssp/my-support/knowledge-base/security-notes-news/2024%2007%20Patch%20Day%20Blog%20V1.pdf"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…