Vulnerability Description
SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. Thus, having a low impact on confidentiality.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sap | Netweaver | 7.5 |
Related Weaknesses (CWE)
References
- https://me.sap.com/notes/3425188Permissions Required
- https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anVendor Advisory
- https://me.sap.com/notes/3425188Permissions Required
- https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anVendor Advisory
FAQ
What is CVE-2024-27898?
CVE-2024-27898 is a vulnerability with a CVSS score of 5.3 (MEDIUM). SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting internal systems behind firewalls that are nor...
How severe is CVE-2024-27898?
CVE-2024-27898 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-27898?
Check the references section above for vendor advisories and patch information. Affected products include: Sap Netweaver.