CVE-2024-21737 Code Injection vulnerability in SAP Application Interface Framework (File Adapter)
A high-privilege user can execute OS commands via a function module in SAP AIF File Adapter, compromising confidentiality, integrity, and availability.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-21737?
CVE-2024-21737 is a high-severity code injection vulnerability in SAP_SE SAP Application Interface Framework (File Adapter), published on 9 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In SAP Application Interface Framework File Adapter - version 702, a high privilege user can use a function module to traverse through various layers and execute OS commands directly. By this, such user can control the behaviour of the application. This leads to considerable impact on confidentiality, integrity and availability.
Weakness: CWE-94
Which versions are affected by CVE-2024-21737?
It affects 1 product.
Products include Sap Application Interface Framework.
How do I fix CVE-2024-21737?
No fix has been published for CVE-2024-21737 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-21737 being exploited?
There is no known exploitation of CVE-2024-21737 in the wild and no public exploit code.
Other vulnerabilities in SAP_SE SAP Application Interface Framework (File Adapter)
Sources
Also known as GHSA-wh97-9rvp-m9hj.