CVE-2024-54198 Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP
An authenticated attacker can craft RFC requests to expose remote service credentials, leading to potential compromise of the remote service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-54198?
CVE-2024-54198 is a high-severity vulnerability in SAP_SE SAP NetWeaver Application Server ABAP, published on 10 Dec 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely compromise the remote service, potentially resulting in a significant impact on the confidentiality, integrity, and availability of the application.
Weakness: CWE-914
Which versions are affected by CVE-2024-54198?
How do I fix CVE-2024-54198?
No fix has been published for CVE-2024-54198 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-54198 being exploited?
There is no known exploitation of CVE-2024-54198 in the wild and no public exploit code.
Sources
Also known as GHSA-5grf-rw7w-63q5.