Riskcovery

CVE-2024-34683

Unrestricted file upload in SAP Document Builder (HTTP service)

State
Published
Severity
6.5 Medium
Published
Jun 11, 2024
Updated
Aug 2, 2024
Reserved
May 7, 2024

Read the record on cve.org

Description

An authenticated attacker can upload malicious file to SAP Document Builder service. When the victim accesses this file, the attacker is allowed to access, modify, or make the related information unavailable in the victim’s browser.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:Lsap

Weaknesses

  • CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

ProductVersions
SAP Document BuilderSAP_SE
  • S4CORE 100Affected
  • 101Affected
  • S4FND 102Affected
  • 103Affected
  • 104Affected
  • 105Affected
  • 106Affected
  • 107Affected
  • 108Affected
  • SAP_BS_FND 702Affected
  • 731Affected
  • 746Affected
  • 747Affected
  • 748Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.