CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2024-30218 – Denial of service (DOS) vulnerability in SAP NetWeaver AS ABAP and ABAP Platform
https://notcve.org/view.php?id=CVE-2024-30218
The ABAP Application Server of SAP NetWeaver as well as ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. This leads to a considerable impact on availability. El servidor de aplicaciones ABAP de SAP NetWeaver, así como la plataforma ABAP, permiten a un atacante impedir que usuarios legítimos accedan a un servicio, ya sea bloqueando o inundando el servicio. Esto tiene un impacto considerable en la disponibilidad. • https://me.sap.com/notes/3359778 https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 • CWE-400: Uncontrolled Resource Consumption CWE-605: Multiple Binds to the Same Port •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-27900 – Missing Authorization check in SAP ABAP Platform
https://notcve.org/view.php?id=CVE-2024-27900
Due to missing authorization check, attacker with business user account in SAP ABAP Platform - version 758, 795, can change the privacy setting of job templates from shared to private. As a result, the selected template would only be accessible to the owner. Debido a la falta de verificación de autorización, un atacante con cuenta de usuario empresarial en SAP ABAP Platform (versión 758, 795) puede cambiar la configuración de privacidad de las plantillas de trabajo de compartida a privada. Como resultado, solo el propietario podrá acceder a la plantilla seleccionada. • https://me.sap.com/notes/3419022 https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 • CWE-862: Missing Authorization •