Riskcovery

CVE-2024-54198

Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP

State
Published
Severity
8.5 High
Published
Dec 10, 2024
Updated
Dec 10, 2024
Reserved
Dec 2, 2024

Read the record on cve.org

Description

In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely compromise the remote service, potentially resulting in a significant impact on the confidentiality, integrity, and availability of the application.

Scores

CVSSScoreVectorSource
3.18.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:Hsap

Weaknesses

  • CWE-914 Improper Control of Dynamically-Identified Variables

Affected Products

ProductVersions
SAP NetWeaver Application Server ABAPSAP_SE
  • KRNL64NUC 7.22Affected
  • 7.22EXTAffected
  • KRNL64UC 7.22Affected
  • 7.53Affected
  • KERNEL 7.22Affected
  • 7.54Affected
  • 7.77Affected
  • 7.89Affected
  • 7.93Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.