CVE-2024-33005

moderate-risk

Published 2024-08-13

Due to the missing authorization checks in the local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application Server (ABAP and Java), and SAP Content Server can impersonate other users and may perform some unintended actions. This could lead to a low impact on confidentiality and a high impact on the integrity and availability of the applications.

Do I need to act?

0.08% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.3/10 Medium

LOCAL / LOW complexity

Affected Products (20)

Netweaver Abap

Netweaver Java

Affected Vendors

Sap

References (2)

Permissions Required https://me.sap.com/notes/3438085

Vendor Advisory https://url.sap/sapsecuritypatchday

/ 100

moderate-risk

Severity 20/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 26/34 · High