CVE-2024-27901
Path Traversal: '.../...//' (CWE-35)
Published: Apr 9, 2024 / Updated: 7mo ago
010
CVSS 7.2EPSS 0.04%High
CVE info copied to clipboard
SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API's. Thus, causing a considerable impact on confidentiality, integrity and availability of the application.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Timeline
CVE Assignment
NVD published the first details for CVE-2024-27901
Apr 9, 2024 at 1:15 AM
CVSS
A CVSS base score of 7.2 has been assigned.
Apr 9, 2024 at 1:20 AM / nvd
First Article
Feedly found the first article mentioning CVE-2024-27901. See article
Apr 9, 2024 at 1:24 AM / National Vulnerability Database
EPSS
EPSS Score was set to: 0% (Percentile: 8%)
Apr 10, 2024 at 2:15 AM
EPSS
EPSS Score was set to: 0% (Percentile: 8%)
Apr 10, 2024 at 12:40 PM
EPSS
EPSS Score was set to: 0.04% (Percentile: 7.9%)
Apr 10, 2024 at 7:48 PM
CVSS Estimate
Feedly estimated the CVSS score as MEDIUM
Jul 16, 2024 at 8:42 PM
News
Navigating SAP Security Notes: April 2024 Patch Tuesday - Security Boulevard
Security Note 3434839 – [CVE-2024-27899] received a CVSS score of 8.8 and addresses a “Security misconfiguration vulnerability in SAP NetWeaver AS Java User Management Engine.” SAP published ten new and two updated Security Notes for April 2024 Patch Tuesday .
SAP April 2024 patch fixes several high severity issues
Missing checks in programming logic in SAP NetWeaver Application Server Java User Management Engine, tracked as CVE-2024-27899 (CVSS score 8.8). Information disclosure vulnerability in its BusinessObjects Web Intelligence product tracked as CVE-2024-25646 (CVSS score 7.7) due to insufficient validation checks when uploading Excel files.
Navigating SAP Security Notes: April 2024 Patch Tuesday
Security Note 3434839 – [CVE-2024-27899] received a CVSS score of 8.8 and addresses a “Security misconfiguration vulnerability in SAP NetWeaver AS Java User Management Engine.” SAP published ten new and two updated Security Notes for April 2024 Patch Tuesday .
SAP Patch Day: April 2024
April Summary – Twelve new and updated SAP security patches released, including three High Priority Notes SAP Security Note #3434839, tagged with a CVSS score of 8.8, patches a Security Misconfiguration vulnerability in SAP NetWeaver AS Java User Management Engine (UME).
SAP Fixes Three High-Severity Flaws | Decipher - Duo Security
SAP has released security updates for three high-severity vulnerabilities in different products, including what it describes as a security misconfiguration flaw in SAP NetWeaver, which serves as the technical foundation for many SAP apps. These two features are optional and disabled by default, but customers can enable and configure them, said researchers with Onapsis in an analysis of the new SAP flaws.
See 8 more articles and social media posts