CVE-2024-45285

Summary

The RFC enabled function module allows a low privileged user to perform denial of service on any user and also change or delete favourite nodes. By sending a crafted packet in the function module targeting specific parameters, the specific targeted user will no longer have access to any functionality of SAP GUI. There is low impact on integrity and availability of the application.

Affected Software

VendorProductVersion RangeStatus
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform700affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform701affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform702affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform731affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform740affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform750affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform751affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform752affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform753affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform754affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform755affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform756affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform757affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform758affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform912affected

Weaknesses

  • CWE-862: CWE-862: Missing Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References