High severity · published Jun 11, 2024
CVE-2024-34688
Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository)
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Due to unrestricted access to the Meta Model
Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks
on the application, which may prevent legitimate users from accessing it. This
can result in no impact on confidentiality and integrity but a high impact on
the availability of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver AS Java · SAP_SE
MMR_SERVER 7.5 · source: vendor
NA
Netweaver Application Server Java · Sap
mmr_server_7.5 · source: NVD
NE
Netweaver · Sap
7.50 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-34688
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-34688
Permissions Required
https://me.sap.com/notes/3460407
Patch
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
More from SAP NetWeaver AS Java
5.3
CVE-2024-47582
XML Entity Expansion Vulnerability in SAP NetWeaver AS JAVA
5.3
CVE-2024-28164
Information Disclosure vulnerability in SAP NetWeaver AS Java (Guided Procedures)