CVE-2024-22127

Published: Mar 12, 2024Modified: Feb 7, 2025

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Exploitability: 2.3 / Impact: 6.0

Source: NVD

Description

SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands which can cause high impact on confidentiality, integrity and availability of the application.

Affected (1)

Products: Sap: Netweaver Application Server Java

1 product

Netweaver Application Server Java

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sap Netweaver Application Server Java	Version 7.5

Related CWEs

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (4)

https://me.sap.com/notes/3433192

Source: cna@sap.com

Permissions Required

https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364

Source: cna@sap.com

Vendor Advisory

https://me.sap.com/notes/3433192

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions Required

https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.