Login Request a demo
Medium severity · published Nov 12, 2024
CVE-2024-47586
NULL Pointer Dereference vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform
5.3
CVSS
3.5%
EPSS
No
On KEV
Description
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a null pointer dereference in the kernel. This dereference will result in the system crashing and rebooting, causing the system to be temporarily unavailable. There is no impact on Confidentiality or Integrity.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver Application Server for ABAP and ABAP Platform · SAP_SE
KRNL64NUC 7.22; 7.22EXT; KRNL64UC 7.22; 7.53; 8.04; KERNEL 7.22; +6 more · source: vendor
NA
Netweaver Abap Application Server · Sap
KRNL64NUC 7.22; 7.22EXT; KRNL64UC 7.22; 7.53; 8.04; KERNEL 7.22; +6 more · source: CISA
Affected product
SN
SAP NetWeaver Application Server for ABAP and ABAP Platform
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-47586
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-47586
me.sap.com
https://me.sap.com/notes/3504390
url.sap
https://url.sap/sapsecuritypatchday
More from SAP NetWeaver Application Server for ABAP and ABAP Platform
9.9
CVE-2025-0070
Improper Authentication in SAP NetWeaver ABAP Server and ABAP Platform
9.0
CVE-2024-34687
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application server for ABAP and ABAP Platform
7.7
CVE-2026-66767
Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform
6.5
CVE-2026-40135
OS Command Injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform
5.4
CVE-2024-45285
Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform