SapCVE-2024-34692CVE-2024-34692
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
14.7%
Due to missing verification of file type or
content, SAP Enable Now allows an authenticated attacker to upload arbitrary
files. These files include executables which might be downloaded and executed
by the user which could host malware. On successful exploitation an attacker
can cause limited impact on confidentiality and Integrity of the application.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| sap | enable_now | * | cpe:2.3:a:sap:enable_now:*:*:*:*:*:*:*:* |
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "SAP Enable Now",
"vendor": "SAP_SE",
"versions": [
{
"status": "affected",
"version": "WPB_MANAGER_CE 10"
},
{
"status": "affected",
"version": "WPB_MANAGER_HANA 10"
},
{
"status": "affected",
"version": "ENABLE_NOW_CONSUMP_DEL 1704"
}
]
}
]
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
14.7%