Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2024-34683

Unrestricted file upload in SAP Document Builder (HTTP service)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

An authenticated attacker can upload malicious file to SAP Document Builder service. When the victim accesses this file, the attacker is allowed to access, modify, or make the related information unavailable in the victim’s browser.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP_SE SAP Document Builder

Default version status: unaffected

  • S4CORE 100affected
  • 101affected
  • S4FND 102affected
  • 103affected
  • 104affected
  • 105affected
  • 106affected
  • 107affected
  • 108affected
  • SAP_BS_FND 702affected
  • 731affected
  • 746affected
  • 747affected
  • 748affected

References