CVE-2024-33006

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
SAP_SE	SAP NetWeaver Application Server ABAP and ABAP Platform	SAP_BASIS 700; SAP_BASIS 701; SAP_BASIS 702; SAP_BASIS 731; SAP_BASIS 740; SAP_BASIS 750; SAP_BASIS 751; SAP_BASIS 752; SAP_BASIS 753; SAP_BASIS 754; SAP_BASIS 755; SAP_BASIS 756; SAP_BASIS 757; SAP_BASIS 758
sap	netweaver	754
sap	netweaver	755
sap	netweaver	756
sap	netweaver	757
sap	netweaver	758

References

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-330073.5PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document con CVE-2024-330084.9SAP Replication Server allows an attacker to use gateway for executing some commands to RSSD. This could result in crashing the Replication CVE-2024-330094.2SAP Global Label Management is vulnerable to SQL injection. On exploitation the attacker can use specially crafted inputs to modify database CVE-2024-33018.5An unsafe .NET object deserialization vulnerability in DELMIA Apriso Release 2019 through Release 2024 could lead to post-authentication rem CVE-2024-330107.5Transient DOS while parsing fragments of MBSSID IE from beacon frame.CVE-2024-330117.5Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.CVE-2024-330127.5Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.CVE-2024-330137.5Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.CVE-2024-330147.5Transient DOS while parsing ESP IE from beacon/probe response frame.CVE-2024-330157.5Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor repo CVE-2024-330166.8memory corruption when an invalid firehose patch command is invoked.CVE-2024-330187.5Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.