CVE-2024-21737CWE-94

Code Injection vulnerability in SAP Application Interface Framework (File Adapter)

High · published January 9, 2024

CVSS v3.1
8.4
EPSS
1%
Percentile
48.6
In the wild
Unconfirmed
What it is

In SAP Application Interface Framework File Adapter - version 702, a high privilege user can use a function module to traverse through various layers and execute OS commands directly. By this, such user can control the behaviour of the application. This leads to considerable impact on confidentiality, integrity and availability.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00611 · 48.6th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-01-09T01:18Z
EPSS history
Timeline
  • 09 JAN 01:18Z
    Code Injection vulnerability in SAP Application Interface Framework (File Adapter)
    cvelistv5