CVE-2024-33005: Missing Authorization check in SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server

Published Aug 13, 2024

Updated

Due to the missing authorization checks in the local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application Server (ABAP and Java), and SAP Content Server can impersonate other users and may perform some unintended actions. This could lead to a low impact on confidentiality and a high impact on the integrity and availability of the applications.

Affected Software

55 affected components

SAP NetWeaver ABAP=kernel_7.22

SAP NetWeaver ABAP=kernel_7.53

SAP NetWeaver ABAP=kernel_7.54

SAP NetWeaver ABAP=kernel_7.77

SAP NetWeaver ABAP=kernel_7.85

SAP NetWeaver ABAP=kernel_7.89

SAP NetWeaver ABAP=kernel_7.93

SAP NetWeaver ABAP=krnl64nuc_7.22

SAP NetWeaver ABAP=krnl64nuc_7.22ext

SAP NetWeaver ABAP=krnl64uc_7.22

SAP NetWeaver ABAP=krnl64uc_7.22ext

SAP NetWeaver ABAP=krnl64uc_7.53

SAP Netweaver Java=kernel_7.22

SAP Netweaver Java=kernel_7.53

SAP Netweaver Java=kernel_7.54

SAP Netweaver Java=kernel_7.77

SAP Netweaver Java=kernel_7.85

SAP Netweaver Java=kernel_7.89

SAP Netweaver Java=kernel_7.93

SAP Netweaver Java=krnl64nuc_7.22

SAP Netweaver Java=krnl64nuc_7.22ext

SAP Netweaver Java=krnl64uc_7.22

SAP Netweaver Java=krnl64uc_7.22ext

SAP Netweaver Java=krnl64uc_7.53

SAP Content Server=kernel_7.22

SAP Content Server=kernel_7.53

SAP Content Server=kernel_7.54

SAP Content Server=kernel_7.77

SAP Content Server=kernel_7.85

SAP Content Server=kernel_7.89

SAP Content Server=kernel_7.93

SAP Content Server=krnl64nuc_7.22

SAP Content Server=krnl64nuc_7.22ext

SAP Content Server=krnl64uc_7.22

SAP Content Server=krnl64uc_7.22ext

SAP Content Server=krnl64uc_7.53

SAP Web Dispatcher=kernel_7.22

SAP Web Dispatcher=kernel_7.53

SAP Web Dispatcher=kernel_7.54

SAP Web Dispatcher=kernel_7.77

SAP Web Dispatcher=kernel_7.85

SAP Web Dispatcher=kernel_7.89

SAP Web Dispatcher=kernel_7.93

SAP Web Dispatcher=krnl64nuc_7.22

SAP Web Dispatcher=krnl64nuc_7.22ext

SAP Web Dispatcher=krnl64uc_7.22

SAP Web Dispatcher=krnl64uc_7.22ext

SAP Web Dispatcher=krnl64uc_7.53

SAP Web Dispatcher=webdisp_7.22_ext

SAP Web Dispatcher=webdisp_7.53

SAP Web Dispatcher=webdisp_7.54

SAP Web Dispatcher=webdisp_7.77

SAP Web Dispatcher=webdisp_7.85

SAP Web Dispatcher=webdisp_7.89

SAP Web Dispatcher=webdisp_7.93

Event History

Aug 13, 2024

CVE Published

via MITRE·03:47 AM

Data Sourced

via MITRE·03:47 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-33005?

CVE-2024-33005 has a low severity rating due to the limited impact on confidentiality.

How do I fix CVE-2024-33005?

To resolve CVE-2024-33005, apply the latest updates or patches provided by SAP for the affected systems.

Which SAP products are affected by CVE-2024-33005?

CVE-2024-33005 affects SAP Web Dispatcher, SAP NetWeaver Application Server (ABAP and Java), and SAP Content Server.

What impact does CVE-2024-33005 have on users?

CVE-2024-33005 allows admin users to impersonate other users, which may lead to unintended actions.

Are there workarounds for CVE-2024-33005?

Currently, SAP recommends applying patches as the primary method to mitigate CVE-2024-33005.

CVE-2024-33005: Missing Authorization check in SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-33005?

How do I fix CVE-2024-33005?

Which SAP products are affected by CVE-2024-33005?

What impact does CVE-2024-33005 have on users?

Are there workarounds for CVE-2024-33005?

Company

Resources

Contact