{"$ref":"https://www.cert.ssi.gouv.fr/openapi.json","affected_systems":[{"description":"Enable Now versions ant\u00e9rieures \u00e0 WPB_MANAGER_HANA 10 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"N/A","vendor":{"name":"SAP","scada":false}}},{"description":"Business Workflow (WebFlow Services) versions ant\u00e9rieures \u00e0 SAP_BASIS 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"N/A","vendor":{"name":"SAP","scada":false}}},{"description":"Enable Now versions ant\u00e9rieures \u00e0 WPB_MANAGER_CE 10 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"N/A","vendor":{"name":"SAP","scada":false}}},{"description":"Business Warehouse - Business Planning and Simulation versions ant\u00e9rieures \u00e0 SAP_BW 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"N/A","vendor":{"name":"SAP","scada":false}}},{"description":"Commerce versions ant\u00e9rieures \u00e0 HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"N/A","vendor":{"name":"SAP","scada":false}}},{"description":"Enable Now versions ant\u00e9rieures \u00e0 ENABLE_NOW_CONSUMP_DEL 1704 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"N/A","vendor":{"name":"SAP","scada":false}}},{"description":"CRM WebClient UI versions ant\u00e9rieures \u00e0 S4FND 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9 WEBCUIF 701, 731, 746, 747, 748, 800, 801","product":{"name":"N/A","vendor":{"name":"SAP","scada":false}}},{"description":"CRM WebClient UI versions ant\u00e9rieures \u00e0 S4FND 104 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"N/A","vendor":{"name":"SAP","scada":false}}},{"description":"PDCE versions ant\u00e9rieures \u00e0 S4CORE 102 et 103 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"N/A","vendor":{"name":"SAP","scada":false}}},{"description":"Business Warehouse - Business Planning and Simulation versions ant\u00e9rieures \u00e0 SAP_BW_VIRTUAL_COMP 701 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"N/A","vendor":{"name":"SAP","scada":false}}},{"description":"S/4HANA Finance (Advanced Payment Management) versions ant\u00e9rieures \u00e0 S4CORE 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"N/A","vendor":{"name":"SAP","scada":false}}},{"description":"NetWeaver Application Server for ABAP and ABAP Platform versions ant\u00e9rieures \u00e0 SAP_BASIS 700,701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 795 et 796 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"N/A","vendor":{"name":"SAP","scada":false}}},{"description":"GUI pour Windows versions ant\u00e9rieures \u00e0 BC-FES-GUI 8 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"N/A","vendor":{"name":"SAP","scada":false}}},{"description":"NetWeaver Knowledge Management XMLEditor versions ant\u00e9rieures \u00e0 KMC-WPC 7.50 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"N/A","vendor":{"name":"SAP","scada":false}}},{"description":"CRM WebClient UI versions ant\u00e9rieures \u00e0 WEBCUIF 701, 731, 746, 747, 748, 800, 801 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"N/A","vendor":{"name":"SAP","scada":false}}},{"description":"PDCE versions ant\u00e9rieures \u00e0 S4COREOP 104, 105,\n106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"N/A","vendor":{"name":"SAP","scada":false}}}],"affected_systems_content":"","content":"## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l'\u00e9diteur pour l'obtention des correctifs (cf. section Documentation).","cves":[{"name":"CVE-2024-34689","url":"https://www.cve.org/CVERecord?id=CVE-2024-34689"},{"name":"CVE-2024-37174","url":"https://www.cve.org/CVERecord?id=CVE-2024-37174"},{"name":"CVE-2024-39597","url":"https://www.cve.org/CVERecord?id=CVE-2024-39597"},{"name":"CVE-2024-37171","url":"https://www.cve.org/CVERecord?id=CVE-2024-37171"},{"name":"CVE-2024-37172","url":"https://www.cve.org/CVERecord?id=CVE-2024-37172"},{"name":"CVE-2024-34685","url":"https://www.cve.org/CVERecord?id=CVE-2024-34685"},{"name":"CVE-2024-39596","url":"https://www.cve.org/CVERecord?id=CVE-2024-39596"},{"name":"CVE-2024-34683","url":"https://www.cve.org/CVERecord?id=CVE-2024-34683"},{"name":"CVE-2024-37180","url":"https://www.cve.org/CVERecord?id=CVE-2024-37180"},{"name":"CVE-2024-39600","url":"https://www.cve.org/CVERecord?id=CVE-2024-39600"},{"name":"CVE-2024-37175","url":"https://www.cve.org/CVERecord?id=CVE-2024-37175"},{"name":"CVE-2024-39594","url":"https://www.cve.org/CVERecord?id=CVE-2024-39594"},{"name":"CVE-2024-37173","url":"https://www.cve.org/CVERecord?id=CVE-2024-37173"},{"name":"CVE-2024-39599","url":"https://www.cve.org/CVERecord?id=CVE-2024-39599"},{"name":"CVE-2024-39598","url":"https://www.cve.org/CVERecord?id=CVE-2024-39598"},{"name":"CVE-2024-39593","url":"https://www.cve.org/CVERecord?id=CVE-2024-39593"},{"name":"CVE-2024-39592","url":"https://www.cve.org/CVERecord?id=CVE-2024-39592"},{"name":"CVE-2024-34692","url":"https://www.cve.org/CVERecord?id=CVE-2024-34692"},{"name":"CVE-2024-39595","url":"https://www.cve.org/CVERecord?id=CVE-2024-39595"}],"links":[],"reference":"CERTFR-2024-AVI-0554","revisions":[{"description":"Version initiale","revision_date":"2024-07-09T00:00:00.000000"}],"risks":[{"description":"Injection de code indirecte \u00e0 distance (XSS)"},{"description":"Atteinte \u00e0 l'int\u00e9grit\u00e9 des donn\u00e9es"},{"description":"Non sp\u00e9cifi\u00e9 par l'\u00e9diteur"},{"description":"Contournement de la politique de s\u00e9curit\u00e9"},{"description":"Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"}],"summary":"De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d'entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une atteinte \u00e0 l'int\u00e9grit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).","title":"Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP","vendor_advisories":[{"published_at":"2024-07-08","title":"Bulletin de s\u00e9curit\u00e9 SAP","url":"https://support.sap.com/content/dam/support/en_us/library/ssp/my-support/knowledge-base/security-notes-news/2024%2007%20Patch%20Day%20Blog%20V1.pdf"}]}