Riskcovery

CVE-2024-27899

Security misconfiguration vulnerability in SAP NetWeaver AS Java User Management Engine

State
Published
Severity
8.8 High
Published
Apr 9, 2024
Updated
Aug 27, 2025
Reserved
Feb 27, 2024

Read the record on cve.org

Description

Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause profound impact on confidentiality and low impact on both integrity and availability.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:Lsap

Weaknesses

  • CWE-640 Weak Password Recovery Mechanism

Affected Products

ProductVersions
SAP NetWeaver AS Java User Management EngineSAP_SE
  • SERVERCORE 7.50Affected
  • J2EE-APPS 7.50Affected
  • UMEADMIN 7.50Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.