CVE-2024-27899CWE-640

Security misconfiguration vulnerability in SAP NetWeaver AS Java User Management Engine

High · published April 9, 2024

CVSS v3.1
8.8
EPSS
0%
Percentile
33.4
In the wild
Unconfirmed
What it is

Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause profound impact on confidentiality and low impact on both integrity and availability.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00403 · 33.4th percentile
Weakness
CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
Published
2024-04-09T00:54Z
EPSS history
Timeline
  • 09 APR 00:54Z
    Security misconfiguration vulnerability in SAP NetWeaver AS Java User Management Engine
    cvelistv5