CVE-2024-21737

CWE-94 — Code Injection3 documents3 sources
Severity
9.1CRITICAL
EPSS
0.2%
top 55.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP SE SAP Application Interface Framework (file Adapter)SAP Application Interface Framework
Timeline
PublishedJan 9

Description

In SAP Application Interface Framework File Adapter - version 702, a high privilege user can use a function module to traverse through various layers and execute OS commands directly. By this, such user can control the behaviour of the application. This leads to considerable impact on confidentiality, integrity and availability.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HExploitability: 1.7 | Impact: 6.0

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-wh97-9rvp-m9hj: In SAP Application Interface Framework File Adapter - version 702, a high privilege user can use a function module to traverse through various layers↗2024-01-09
▶
CVEList
Code Injection vulnerability in SAP Application Interface Framework (File Adapter)↗2024-01-09
▶