Critical severity · published Mar 12, 2024
CVE-2024-22127
SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to…
9.1
CVSS
1.6%
EPSS
No
On KEV
Description
SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands which can cause high impact on confidentiality, integrity and availability of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
Netweaver Application Server Java · Sap
7.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-22127
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-22127
Permissions Required
https://me.sap.com/notes/3433192
Vendor Advisory
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364
More from Netweaver Application Server Java
10.0
CVE-2020-6287
SAP NetWeaver Missing Authentication for Critical Function Vulnerability
10.0
CVE-2010-5326
SAP NetWeaver Remote Code Execution Vulnerability
9.8
CVE-2016-2386
SAP NetWeaver SQL Injection Vulnerability
7.5
CVE-2017-12637
SAP NetWeaver Directory Traversal Vulnerability
7.5
CVE-2016-3976
SAP NetWeaver Directory Traversal Vulnerability