What is CVE-2024-27899?

CVE-2024-27899 is a high-severity vulnerability in Sap Se Netweaver As Java User Management Engine, classified under Weak Password Recovery Mechanism for Forgotten Password. CVSS score: 8.8/10. Published 2024-04-09.

How severe is CVE-2024-27899?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Sap Se Netweaver As Java User Management Engine

CVE-2024-27899

Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause profound impact on confidentiality and low impact on both integrity and availability.

EPSS: 0.004 (33.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L.

Affected products

Sap_se Sap Netweaver As Java User Management Engine — versions SERVERCORE 7.50, J2EE-APPS 7.50, UMEADMIN 7.50

Weakness classification (CWE)

CWE-640 — Weak Password Recovery Mechanism for Forgotten Password

References

Frequently asked questions

What is CVE-2024-27899?: CVE-2024-27899 is a high-severity vulnerability in Sap Se Netweaver As Java User Management Engine, classified under Weak Password Recovery Mechanism for Forgotten Password. CVSS score: 8.8/10. Published 2024-04-09.
How severe is CVE-2024-27899?: High severity. CVSS v3 base score is 8.8 out of 10.