Lucene search

SapCVE-2024-33008

HistoryMay 14, 2024 - 4:17 p.m.

CVE-2024-33008

2024-05-1416:17:15

CWE-787

sap

web.nvd.nist.gov

sap replication server

command execution

memory corruption

system availability

cve-2024-33008

nvd

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

AI Score

5.5

Confidence

High

EPSS

Percentile

9.0%

JSON

SAP Replication Server allows an attacker to use gateway for executing some commands to RSSD. This could result in crashing the Replication Server due to memory corruption with high impact on Availability of the system.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP Replication Server",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "16.0"
      },
      {
        "status": "affected",
        "version": "16.0.3"
      },
      {
        "status": "affected",
        "version": "16.0.4"
      }
    ]
  }
]

References

me.sap.com/notes/3349468

support.sap.com/en/my-support/knowledge-base/security-notes-news.html

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

AI Score

5.5

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-33008