Log in Start free

Vulnerability · Published Jan 9, 2024 · Assigned by sap

CVE-2024-22124Information Disclosure vulnerability in SAP NetWeaver Internet Communication Manager

Medium 4.1

In plain English

A medium-severity security flaw in SAP NetWeaver (Internet Communication Manager) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)4.1Medium
Exploit odds (30 days)0.3%top 74.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22_EXT, WEBDISP 7.22_EXT, WEBDISP 7.53, WEBDISP 7.54, could allow an attacker to access information which would otherwise be restricted causing high impact on confidentiality.

Affected products (as reported)

VendorProductVersions
SAP_SE SAP NetWeaver (Internet Communication Manager) KERNEL 7.22KERNEL 7.53KERNEL 7.54KRNL64UC 7.22KRNL64UC 7.22EXTKRNL64UC 7.53KRNL64NUC 7.22KRNL64NUC 7.22_EXT

Weakness: CWE-497 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

References