Medium severity · published Jul 9, 2024
CVE-2024-34692
Due to missing verification of file type or content, SAP Enable Now allows an authenticated attacker to upload arbitrary files
4.6
CVSS
0.2%
EPSS
No
On KEV
Description
Due to missing verification of file type or
content, SAP Enable Now allows an authenticated attacker to upload arbitrary
files. These files include executables which might be downloaded and executed
by the user which could host malware. On successful exploitation an attacker
can cause limited impact on confidentiality and Integrity of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EN
Enable Now · Sap
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-34692
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-34692
Permissions Required
https://me.sap.com/notes/3476340
Vendor Advisory
https://url.sap/sapsecuritypatchday
More from Enable Now
9.8
CVE-2019-0403
SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CSV Command Injection
8.8
CVE-2019-0341
The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set
7.5
CVE-2019-0405
SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a user enumeration…
7.5
CVE-2019-0404
SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leading to Information Disclosure
6.5
CVE-2019-0385
SAP Enable Now, before version 1908, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability