Skip to main content

Improper Control of Dynamically-Identified Variables

CVE-2024-54198

High
8.5/10

Summary

In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely compromise the remote service, potentially resulting in a significant impact on the confidentiality, integrity, and availability of the application.

  • HIGH
  • NETWORK
  • HIGH
  • CHANGED
  • NONE
  • LOW
  • HIGH
  • HIGH

CWE-914 - Improper Control of Dynamically-Identified Variables

The software does not properly restrict reading from or writing to dynamically-identified variables.

References

Advisory Timeline

  • Published