CVE-2024-27899
Last modified
CVE-2024-27899 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause profound impact on confidentiality and low impact on both integrity and availability. . EPSS estimates a 0.40% chance of exploitation in the next 30 days.
Description
Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause profound impact on confidentiality and low impact on both integrity and availability.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-27899?
How severe is CVE-2024-27899?
How do I fix CVE-2024-27899?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-27892Affected platforms running Arista EOS with OpenConfig config…9.6
- CVE-2024-27894The Pulsar Functions Worker includes a capability that permi…8.8
- CVE-2024-27895Vulnerability of permission control in the window module. Su…7.5
- CVE-2024-27896Input verification vulnerability in the log module. Impact: …7.5
- CVE-2024-27897Input verification vulnerability in the call module. Impact:…7.5
- CVE-2024-27898SAP NetWeaver application, due to insufficient input validat…5.3
- CVE-2024-2790The HT Mega – Absolute Addons For Elementor plugin for WordP…5.4
- CVE-2024-27900Due to missing authorization check, attacker with business u…5.3
- CVE-2024-27901SAP Asset Accounting could allow a high privileged attacker …7.2
- CVE-2024-27902Applications based on SAP GUI for HTML in SAP NetWeaver AS A…6.1
- CVE-2024-27903OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier c…9.8
- CVE-2024-27905** UNSUPPORTED WHEN ASSIGNED ** Exposure of Sensitive Inform…9.1
Are you affected by CVE-2024-27899?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST