CVE-2024-27899
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Summary
Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause profound impact on confidentiality and low impact on both integrity and availability.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SAP_SE | SAP NetWeaver AS Java User Management Engine | SERVERCORE 7.50 | affected |
| SAP_SE | SAP NetWeaver AS Java User Management Engine | J2EE-APPS 7.50 | affected |
| SAP_SE | SAP NetWeaver AS Java User Management Engine | UMEADMIN 7.50 | affected |
Weaknesses
- CWE-640: CWE-640: Weak Password Recovery Mechanism
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
CVE Program Container
Additional References
- https://me.sap.com/notes/3434839
- https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364
References
- https://me.sap.com/notes/3434839
- https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.