Vulnerability · Published Mar 12, 2024 · Assigned by sap
CVE-2024-22127Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in)
Critical 9.1
In plain English
A critical-severity command injection in SAP NetWeaver AS Java (Administrator Log Viewer plug-in) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands which can cause high impact on confidentiality, integrity and availability of the application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP NetWeaver AS Java (Administrator Log Viewer plug-in) | 7.50 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H