cve-2024-27901
Vulnerability from cvelistv5
Published
2024-04-09 00:55
Modified
2024-09-06 18:01
Severity ?
EPSS score ?
0.27%
(0.49709)
Summary
SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API's. Thus, causing a considerable impact on confidentiality, integrity and availability of the application.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP_SE | SAP Asset Accounting |
Version: SAP_APPL 600 Version: SAP_APPL 602 Version: SAP_APPL 603 Version: SAP_APPL 604 Version: SAP_APPL 605 Version: SAP_APPL 606 Version: SAP_FIN617 Version: SAP_FIN 618 Version: SAP_FIN700 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T00:41:55.774Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://me.sap.com/notes/3438234", }, { tags: [ "x_transferred", ], url: "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364", }, ], title: "CVE Program Container", }, { affected: [ { cpes: [ "cpe:2.3:a:sap:asset_accounting:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "asset_accounting", vendor: "sap", versions: [ { status: "affected", version: "sap_appl600", }, { status: "affected", version: "sap_appl602", }, { status: "affected", version: "sap_appl603", }, { status: "affected", version: "sap_appl604", }, { status: "affected", version: "sap_appl605", }, { status: "affected", version: "sap_appl606", }, { status: "affected", version: "sap_fin617", }, { status: "affected", version: "sap_fin618", }, { status: "affected", version: "sap_fin700", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2024-27901", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-08-07T16:26:56.367266Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-09-06T18:01:25.580Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "SAP Asset Accounting", vendor: "SAP_SE", versions: [ { status: "affected", version: "SAP_APPL 600", }, { status: "affected", version: "SAP_APPL 602", }, { status: "affected", version: "SAP_APPL 603", }, { status: "affected", version: "SAP_APPL 604", }, { status: "affected", version: "SAP_APPL 605", }, { status: "affected", version: "SAP_APPL 606", }, { status: "affected", version: "SAP_FIN617", }, { status: "affected", version: "SAP_FIN 618", }, { status: "affected", version: "SAP_FIN700", }, ], }, ], descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "<p>SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API's. Thus, causing a considerable impact on confidentiality, integrity and availability of the application.</p>", }, ], value: "SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API's. Thus, causing a considerable impact on confidentiality, integrity and availability of the application.\n\n", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.2, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-35", description: "CWE-35: Path Traversal", lang: "eng", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-04-09T00:55:03.642Z", orgId: "e4686d1a-f260-4930-ac4c-2f5c992778dd", shortName: "sap", }, references: [ { url: "https://me.sap.com/notes/3438234", }, { url: "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364", }, ], source: { discovery: "UNKNOWN", }, title: "Directory Traversal vulnerability in SAP Asset Accounting", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "e4686d1a-f260-4930-ac4c-2f5c992778dd", assignerShortName: "sap", cveId: "CVE-2024-27901", datePublished: "2024-04-09T00:55:03.642Z", dateReserved: "2024-02-27T06:26:16.787Z", dateUpdated: "2024-09-06T18:01:25.580Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { nvd: "{\"cve\":{\"id\":\"CVE-2024-27901\",\"sourceIdentifier\":\"cna@sap.com\",\"published\":\"2024-04-09T01:15:48.993\",\"lastModified\":\"2024-11-21T09:05:22.907\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API's. Thus, causing a considerable impact on confidentiality, integrity and availability of the application.\\n\\n\"},{\"lang\":\"es\",\"value\":\"SAP Asset Accounting podría permitir que un atacante con altos privilegios aproveche la validación insuficiente de la información de ruta proporcionada por los usuarios y la pase a las API de archivos. Provocando así un impacto considerable en la confidencialidad, integridad y disponibilidad de la aplicación.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cna@sap.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"cna@sap.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-35\"}]}],\"references\":[{\"url\":\"https://me.sap.com/notes/3438234\",\"source\":\"cna@sap.com\"},{\"url\":\"https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364\",\"source\":\"cna@sap.com\"},{\"url\":\"https://me.sap.com/notes/3438234\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}", vulnrichment: { containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://me.sap.com/notes/3438234\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:41:55.774Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-27901\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-07T16:26:56.367266Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:sap:asset_accounting:*:*:*:*:*:*:*:*\"], \"vendor\": \"sap\", \"product\": \"asset_accounting\", \"versions\": [{\"status\": \"affected\", \"version\": \"sap_appl600\"}, {\"status\": \"affected\", \"version\": \"sap_appl602\"}, {\"status\": \"affected\", \"version\": \"sap_appl603\"}, {\"status\": \"affected\", \"version\": \"sap_appl604\"}, {\"status\": \"affected\", \"version\": \"sap_appl605\"}, {\"status\": \"affected\", \"version\": \"sap_appl606\"}, {\"status\": \"affected\", \"version\": \"sap_fin617\"}, {\"status\": \"affected\", \"version\": \"sap_fin618\"}, {\"status\": \"affected\", \"version\": \"sap_fin700\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-29T14:12:32.132Z\"}}], \"cna\": {\"title\": \"Directory Traversal vulnerability in SAP Asset Accounting\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"SAP_SE\", \"product\": \"SAP Asset Accounting\", \"versions\": [{\"status\": \"affected\", \"version\": \"SAP_APPL 600\"}, {\"status\": \"affected\", \"version\": \"SAP_APPL 602\"}, {\"status\": \"affected\", \"version\": \"SAP_APPL 603\"}, {\"status\": \"affected\", \"version\": \"SAP_APPL 604\"}, {\"status\": \"affected\", \"version\": \"SAP_APPL 605\"}, {\"status\": \"affected\", \"version\": \"SAP_APPL 606\"}, {\"status\": \"affected\", \"version\": \"SAP_FIN617\"}, {\"status\": \"affected\", \"version\": \"SAP_FIN 618\"}, {\"status\": \"affected\", \"version\": \"SAP_FIN700\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://me.sap.com/notes/3438234\"}, {\"url\": \"https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API's. Thus, causing a considerable impact on confidentiality, integrity and availability of the application.\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"<p>SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API's. Thus, causing a considerable impact on confidentiality, integrity and availability of the application.</p>\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"eng\", \"type\": \"CWE\", \"cweId\": \"CWE-35\", \"description\": \"CWE-35: Path Traversal\"}]}], \"providerMetadata\": {\"orgId\": \"e4686d1a-f260-4930-ac4c-2f5c992778dd\", \"shortName\": \"sap\", \"dateUpdated\": \"2024-04-09T00:55:03.642Z\"}}}", cveMetadata: "{\"cveId\": \"CVE-2024-27901\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-06T18:01:25.580Z\", \"dateReserved\": \"2024-02-27T06:26:16.787Z\", \"assignerOrgId\": \"e4686d1a-f260-4930-ac4c-2f5c992778dd\", \"datePublished\": \"2024-04-09T00:55:03.642Z\", \"assignerShortName\": \"sap\"}", dataType: "CVE_RECORD", dataVersion: "5.1", }, }, }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.