CVE-2024-21737

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

In SAP Application Interface Framework File Adapter - version 702, a high privilege user can use a function module to traverse through various layers and execute OS commands directly. By this, such user can control the behaviour of the application. This leads to considerable impact on confidentiality, integrity and availability.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
SAP_SE	SAP Application Interface Framework (File Adapter)	702

References

https://me.sap.com/notes/3411869Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
https://me.sap.com/notes/3411869Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Timeline

Published: Jan 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-217385.4SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting CVE-2024-217395.3Geehy APM32F103CCT6, APM32F103RCT6, APM32F103RCT7, and APM32F103VCT6 devices have Incorrect Access Control.CVE-2024-21748.8Inappropriate implementation in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption CVE-2024-217407.4Artery AT32F415CBT7 and AT32F421C8T7 devices have Incorrect Access Control.CVE-2024-217419.8GigaDevice GD32E103C8T6 devices have Incorrect Access Control.CVE-2024-217425.3Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited b CVE-2024-217438.8Privilege Escalation vulnerability in favethemes Houzez Login Register houzez-login-register.This issue affects Houzez Login Register: from CVE-2024-217445.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mapster Technology Inc. Mapster WP Map CVE-2024-217455.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Laybuy Laybuy Payment Extension for Wo CVE-2024-217467.5Authentication Bypass by Spoofing vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Identity Spoofing.This issue affects CVE-2024-217474.9Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP | Complete HR solution w CVE-2024-217485.4Missing Authorization vulnerability in Icegram.This issue affects Icegram: from n/a through 3.1.21.