Vulnerability · Published Jul 9, 2024 · Assigned by sap
CVE-2024-34692[CVE-2024-34692] Unrestricted File upload vulnerability in SAP Enable Now
Low 3.3
In plain English
A low-severity unrestricted file upload in SAP Enable Now from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 92.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Due to missing verification of file type or content, SAP Enable Now allows an authenticated attacker to upload arbitrary files. These files include executables which might be downloaded and executed by the user which could host malware. On successful exploitation an attacker can cause limited impact on confidentiality and Integrity of the application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP Enable Now | WPB_MANAGER_CE 10WPB_MANAGER_HANA 10ENABLE_NOW_CONSUMP_DEL 1704 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N