SAP Web Dispatcher / NetWeaver Auth Bypass: User Impersonation
CVE-2024-33005 Published on August 13, 2024
Missing Authorization check in SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server
Due to the missing authorization checks in the
local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application
Server (ABAP and Java), and SAP Content Server can impersonate other users and
may perform some unintended actions. This could lead to a low impact on
confidentiality and a high impact on the integrity and availability of the
applications.
Vulnerability Analysis
CVE-2024-33005 can be exploited with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a high impact on integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2024-33005 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2024-33005
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-33005 are published in these products:
Affected Versions
SAP_SE SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server:- Version KRNL64NUC 7.22 is affected.
- Version KRNL64NUC 7.22EXT is affected.
- Version KRNL64UC 7.22 is affected.
- Version KRNL64UC 7.22EXT is affected.
- Version KRNL64UC 7.53 is affected.
- Version WEBDISP 7.53 is affected.
- Version WEBDISP 7.77 is affected.
- Version WEBDISP 7.85 is affected.
- Version WEBDISP 7.22_EXT is affected.
- Version WEBDISP 7.89 is affected.
- Version WEBDISP 7.54 is affected.
- Version WEBDISP 7.93 is affected.
- Version KERNEL 7.22 is affected.
- Version KERNEL 7.53 is affected.
- Version KERNEL 7.77 is affected.
- Version KERNEL 7.85 is affected.
- Version KERNEL 7.89 is affected.
- Version KERNEL 7.54 is affected.
- Version KERNEL 7.93 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.