CVE-2024-22124 MEDIUM

CVE-2024-22124: Information Disclosure vulnerability in SAP NetWeaver Internet Communication Manager

Vendor Sap_Se
Product SAP NetWeaver (Internet Communication Manager)
Weakness CWE-497
Published January 9, 2024
Last update November 14, 2024
View on NVD All CVEs

CVSS base score

4.1/10
Attack vector Local
Attack complexity High
Privileges required High
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22_EXT, WEBDISP 7.22_EXT, WEBDISP 7.53, WEBDISP 7.54, could allow an attacker to access information which would otherwise be restricted causing high impact on confidentiality.

Key dates

02Disclosure timeline

January 9, 2024 CVE published
November 14, 2024 Record updated