CVE-2024-33005

Missing Authorization check in SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server

State: Published
Severity: 6.3 Medium
Published: Aug 13, 2024
Updated: Aug 13, 2024
Reserved: Apr 23, 2024

Read the record on cve.org

Description

Due to the missing authorization checks in the local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application Server (ABAP and Java), and SAP Content Server can impersonate other users and may perform some unintended actions. This could lead to a low impact on confidentiality and a high impact on the integrity and availability of the applications.

Scores

CVSS	Score	Vector	Source
3.1	6.3 Medium	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H	sap

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content ServerSAP_SE	KRNL64NUC 7.22Affected KRNL64NUC 7.22EXTAffected KRNL64UC 7.22Affected KRNL64UC 7.22EXTAffected KRNL64UC 7.53Affected WEBDISP 7.53Affected WEBDISP 7.77Affected WEBDISP 7.85Affected WEBDISP 7.22_EXTAffected WEBDISP 7.89Affected WEBDISP 7.54Affected WEBDISP 7.93Affected KERNEL 7.22Affected KERNEL 7.53Affected KERNEL 7.77Affected KERNEL 7.85Affected KERNEL 7.89Affected KERNEL 7.54Affected KERNEL 7.93Affected

Product

Versions

SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content ServerSAP_SE

KRNL64NUC 7.22Affected
KRNL64NUC 7.22EXTAffected
KRNL64UC 7.22Affected
KRNL64UC 7.22EXTAffected
KRNL64UC 7.53Affected
WEBDISP 7.53Affected
WEBDISP 7.77Affected
WEBDISP 7.85Affected
WEBDISP 7.22_EXTAffected
WEBDISP 7.89Affected
WEBDISP 7.54Affected
WEBDISP 7.93Affected
KERNEL 7.22Affected
KERNEL 7.53Affected
KERNEL 7.77Affected
KERNEL 7.85Affected
KERNEL 7.89Affected
KERNEL 7.54Affected
KERNEL 7.93Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.