CVE-2024-27898 Server-Side Request Forgery in SAP NetWeaver
An attacker can exploit insufficient input validation in SAP NetWeaver to perform Server-Side Request Forgery, accessing internal systems and causing low impact on confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-27898?
CVE-2024-27898 is a medium-severity server-side request forgery vulnerability in Sap Netweaver, published on 9 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. Thus, having a low impact on confidentiality.
Weakness: CWE-918
Which versions are affected by CVE-2024-27898?
It affects 1 product.
Products include Sap Netweaver.
How do I fix CVE-2024-27898?
No fix has been published for CVE-2024-27898 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-27898 being exploited?
There is no known exploitation of CVE-2024-27898 in the wild and no public exploit code.
Other vulnerabilities in Sap Netweaver
Sources
Also known as GHSA-qqv3-2v93-cwjw.