Medium severity · published Jun 11, 2024
CVE-2024-33001
Denial of service (DOS) in SAP NetWeaver and ABAP platform
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
SAP NetWeaver and ABAP platform allows an
attacker to impede performance for legitimate users by crashing or flooding the
service.
An
impact of this Denial of Service vulnerability might be long response delays
and service interruptions, thus degrading the service quality experienced by
legitimate users causing high impact on availability of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver and ABAP platform · SAP_SE
ST-PI 2008_1_700; 2008_1_710; 740 · source: vendor, CISA
NA
Netweaver Application Server Abap · Sap
740; 2008_1_710; st-pi_2008_1_700 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-33001
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-33001
Permissions Required
https://me.sap.com/notes/3453170
Patch
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
More from SAP NetWeaver and ABAP platform
10.0
CVE-2022-22536
SAP Multiple Products HTTP Request Smuggling Vulnerability
9.8
CVE-2026-34265
Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform
4.3
CVE-2026-76963
Missing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP Platform
4.3
CVE-2025-42986
Missing Authorization check in SAP NetWeaver and ABAP Platform
4.3
CVE-2024-47593
Information Disclosure Vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform