Advisory
On 11.02.2025 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within SAP Enterprise Project Connection.
SAP Note 3567172 addresses "[CVE-2024-38819] Multiple vulnerabilities in SAP Enterprise Project Connection" to prevent denial of service (dos)directory traversal (read)information disclosure with a high risk for exploitation.
A workaround does not exist, according to SAP Security Advisory team. It is advisable to implement the correction as monthly patch process, the team suggests.
Risk specification
This note addresses multiple CVEs in libraries used in SAP Enterprise Project Connection: - The functional web frameworks WebMvc.fn and WebFlux.fn in Spring Applications allow an unauthenticated attacker to read arbitrary files by crafting a malicious HTTP request, potentially accessing any file on the system that is accessible to the application process. - The Spring Framework DataBinder enables an authenticated attacker to manipulate input data and bypass security controls, leading to unauthorized access to sensitive information. - Spring MVC controller methods with the @RequestBody byte[] method parameter allow an authenticated attacker to execute a Denial of Service (DoS) attack by sending malicious requests.Solution
The vulnerable Spring Framework dependencies have been updated.
