#VU101375 Server-Side Request Forgery (SSRF) in SAP NetWeaver Administrator - CVE-2024-54197

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU101375

#VU101375 Server-Side Request Forgery (SSRF) in SAP NetWeaver Administrator - CVE-2024-54197

Published: December 10, 2024


Vulnerability identifier: #VU101375
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2024-54197
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
SAP NetWeaver Administrator
Software vendor:
SAP

Description

The disclosed vulnerability allows a remote user to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input within the System Overview component. A remote user can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems and enumerate accessible HTTP endpoints in the internal network.



Remediation

Install updates from vendor's website.

External links