CVE-2024-54198: fallo de gravedad alta en SAP_SE SAP NetWeaver Application Server ABAP
Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.5epss 0.6%
In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely compromise the remote service, potentially resulting in a significant impact on the confidentiality, integrity, and availability of the application.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Productos afectados
SAP_SE · SAP NetWeaver Application Server ABAPCVEs relacionadas — SAP_SE SAP NetWeaver Application Server ABAP
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-44747CRITICALMemory Corruption vulnerability in SAP NetWeaver Application Server ABAPEPSS 0.6%CVE-2025-23186HIGHMixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAPEPSS 0.5%CVE-2024-47593MEDIUMInformation Disclosure Vulnerability in SAP NetWeaver Application Server for ABAP and ABAP PlatformEPSS 0.4%CVE-2026-66779MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAPEPSS 0.3%CVE-2024-41732MEDIUMImproper Access Control in SAP Netweaver Application Server ABAPEPSS 0.3%CVE-2025-0068MEDIUMMissing Authorization check in Remote Function Call (RFC) in SAP NetWeaver Application Server ABAPEPSS 0.3%