Arbitrary file upload in SAP Enable Now
CVE-2024-34692
Due to missing verification of file type or content, SAP Enable Now allows an authenticated attacker to upload arbitrary files. These files include executables which might be downloaded and executed by the user which could host malware. On successful exploitation an attacker can cause limited impact on confidentiality and Integrity of the application.
Vulnerability class: Unrestricted File Upload
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (7.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 7th percentile — 7.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- SAP Enable Now
- SAP Se Enable Now — versions WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704
Weakness classification (CWE)
Public proof-of-concept exploits
References
- url.sap/sapsecuritypatchday (Vendor Advisory)
- me.sap.com/notes/3476340 (Permissions Required)
Frequently asked questions
- What is CVE-2024-34692?
- CVE-2024-34692 is a low-severity vulnerability in SAP Enable Now, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 3.3/10. Published 2024-07-09.
- How severe is CVE-2024-34692?
- Low severity. CVSS v3 base score is 3.3 out of 10.
- Is CVE-2024-34692 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.