CVE-2024-33005

Published: Aug 13, 2024Modified: Jun 17, 2026

6.3

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

Exploitability: 0.8 / Impact: 5.5

Source: NVD

Description

Due to the missing authorization checks in the local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application Server (ABAP and Java), and SAP Content Server can impersonate other users and may perform some unintended actions. This could lead to a low impact on confidentiality and a high impact on the integrity and availability of the applications.

Affected (55)

Products: Sap: Netweaver Abap, Netweaver Java, Content Server, Web Dispatcher

4 products

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Sap Netweaver Abap	Version kernel_7.22
Sap Netweaver Abap	Version kernel_7.53
Sap Netweaver Abap	Version kernel_7.54
Sap Netweaver Abap	Version kernel_7.77
Sap Netweaver Abap	Version kernel_7.85
Sap Netweaver Abap	Version kernel_7.89
Sap Netweaver Abap	Version kernel_7.93
Sap Netweaver Abap	Version krnl64nuc_7.22
Sap Netweaver Abap	Version krnl64nuc_7.22ext
Sap Netweaver Abap	Version krnl64uc_7.22
Sap Netweaver Abap	Version krnl64uc_7.22ext
Sap Netweaver Abap	Version krnl64uc_7.53

Configuration B

12 vulnerable

Vulnerable Software	Affected Versions
Sap Netweaver Java	Version kernel_7.22
Sap Netweaver Java	Version kernel_7.53
Sap Netweaver Java	Version kernel_7.54
Sap Netweaver Java	Version kernel_7.77
Sap Netweaver Java	Version kernel_7.85
Sap Netweaver Java	Version kernel_7.89
Sap Netweaver Java	Version kernel_7.93
Sap Netweaver Java	Version krnl64nuc_7.22
Sap Netweaver Java	Version krnl64nuc_7.22ext
Sap Netweaver Java	Version krnl64uc_7.22
Sap Netweaver Java	Version krnl64uc_7.22ext
Sap Netweaver Java	Version krnl64uc_7.53

Configuration C

12 vulnerable

Vulnerable Software	Affected Versions
Sap Content Server	Version kernel_7.22
Sap Content Server	Version kernel_7.53
Sap Content Server	Version kernel_7.54
Sap Content Server	Version kernel_7.77
Sap Content Server	Version kernel_7.85
Sap Content Server	Version kernel_7.89
Sap Content Server	Version kernel_7.93
Sap Content Server	Version krnl64nuc_7.22
Sap Content Server	Version krnl64nuc_7.22ext
Sap Content Server	Version krnl64uc_7.22
Sap Content Server	Version krnl64uc_7.22ext
Sap Content Server	Version krnl64uc_7.53

Configuration D

19 vulnerable

Vulnerable Software	Affected Versions
Sap Web Dispatcher	Version kernel_7.22
Sap Web Dispatcher	Version kernel_7.53
Sap Web Dispatcher	Version kernel_7.54
Sap Web Dispatcher	Version kernel_7.77
Sap Web Dispatcher	Version kernel_7.85
Sap Web Dispatcher	Version kernel_7.89
Sap Web Dispatcher	Version kernel_7.93
Sap Web Dispatcher	Version krnl64nuc_7.22
Sap Web Dispatcher	Version krnl64nuc_7.22ext
Sap Web Dispatcher	Version krnl64uc_7.22
Sap Web Dispatcher	Version krnl64uc_7.22ext
Sap Web Dispatcher	Version krnl64uc_7.53
Sap Web Dispatcher	Version webdisp_7.22_ext
Sap Web Dispatcher	Version webdisp_7.53
Sap Web Dispatcher	Version webdisp_7.54
Sap Web Dispatcher	Version webdisp_7.77
Sap Web Dispatcher	Version webdisp_7.85
Sap Web Dispatcher	Version webdisp_7.89
Sap Web Dispatcher	Version webdisp_7.93

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://me.sap.com/notes/3438085

Source: cna@sap.com

Permissions Required

https://url.sap/sapsecuritypatchday

Source: cna@sap.com

Vendor Advisory

Timeline

No history available yet.