{"$ref":"https://www.cert.ssi.gouv.fr/openapi.json","affected_systems":[{"description":"SAP pour Oil & Gas versions 600, 602, 603, 604, 605, 606, 617, 618, 800, 802, 803, 804, 805, 806, 807 et 807 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"SAP pour Oil & Gas","vendor":{"name":"SAP","scada":false}}},{"description":"Commerce Cloud versions HY_COM 1808, 1811, 1905, 2005, 2105, 2011, 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"Commerce Cloud","vendor":{"name":"SAP","scada":false}}},{"description":"Business Warehouse (BEx Analyzer) versions DW4CORE 200, DW4CORE 300, DW4CORE 400, SAP_BW 700, SAP_BW 701, SAP_BW 702, SAP_BW 731, SAP_BW 740, SAP_BW 750, SAP_BW 751, SAP_BW 752, SAP_BW 753, SAP_BW 754, SAP_BW 755, SAP_BW 756, SAP_BW 757 et SAP_BW 758 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"Business Warehouse","vendor":{"name":"SAP","scada":false}}},{"description":"S/4 HANA version 900 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"S/4HANA (Manage Incoming Payment Files)","vendor":{"name":"SAP","scada":false}}},{"description":"NetWeaver BW (BEx Analyzer) versions DW4CORE 200, DW4CORE 300, DW4CORE 400, SAP_BW 700, SAP_BW 701, SAP_BW 702, SAP_BW 731, SAP_BW 740, SAP_BW 750, SAP_BW 751, SAP_BW 752, SAP_BW 753, SAP_BW 754, SAP_BW 755, SAP_BW 756, SAP_BW 757 et SAP_BW 758 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"NetWeaver BW","vendor":{"name":"SAP","scada":false}}},{"description":"NetWeaver AS pour Java (Destination Service et Logon Application) version 7.50 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"SAP NetWeaver AS Java","vendor":{"name":"SAP","scada":false}}},{"description":"BusinessObjects Business Intelligence Platform version 430 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"SAP BusinessObjects Business Intelligence","vendor":{"name":"SAP","scada":false}}},{"description":"Student Life Cycle Management (SLcM) versions 617, 618, 800, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"SAP Student Life Cycle Management","vendor":{"name":"SAP","scada":false}}},{"description":"BusinessObjects Business Intelligence Platform versions ENTERPRISE 430 et 440 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"SAP BusinessObjects Business Intelligence","vendor":{"name":"SAP","scada":false}}},{"description":"Replication Server versions 16.0.3 et 16.0.4 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"Replication Server","vendor":{"name":"SAP","scada":false}}},{"description":"SAP NetWeaver Application Server pour ABAP et ABAP Platform, Versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 912 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"NetWeaver Application Server ABAP et ABAP Platform","vendor":{"name":"SAP","scada":false}}},{"description":"Production et Revenue Accounting (Tobin interface) versions S4CEXT 106, S4CEXT 107, S4CEXT 108, IS-PRA 605, IS-PRA 606, IS-PRA 616, IS-PRA 617, IS-PRA 618, IS-PRA 800, IS-PRA 801, IS-PRA 802, IS-PRA 803, IS-PRA 804 et IS-PRA 805 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"Production et Revenue Accounting","vendor":{"name":"SAP","scada":false}}},{"description":"NetWeaver Enterprise Portal version 7.50 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"NetWeaver Enterprise Portal","vendor":{"name":"SAP","scada":false}}},{"description":"NetWeaver Application Server pour ABAP (CRM Blueprint Application Builder Panel) versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H et 75I sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"NetWeaver Application Server pour ABAP","vendor":{"name":"SAP","scada":false}}},{"description":"S/4HANA eProcurement versions SAP_APPL 606, SAP_APPL 617, SAP_APPL 618, S4CORE 102, S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107 et S4CORE 108 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"S/4HANA eProcurement","vendor":{"name":"SAP","scada":false}}}],"affected_systems_content":"","content":"## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l'\u00e9diteur pour l'obtention des correctifs (cf. section Documentation).","cves":[{"name":"CVE-2024-45281","url":"https://www.cve.org/CVERecord?id=CVE-2024-45281"},{"name":"CVE-2024-44115","url":"https://www.cve.org/CVERecord?id=CVE-2024-44115"},{"name":"CVE-2024-45279","url":"https://www.cve.org/CVERecord?id=CVE-2024-45279"},{"name":"CVE-2024-44117","url":"https://www.cve.org/CVERecord?id=CVE-2024-44117"},{"name":"CVE-2024-33003","url":"https://www.cve.org/CVERecord?id=CVE-2024-33003"},{"name":"CVE-2023-0215","url":"https://www.cve.org/CVERecord?id=CVE-2023-0215"},{"name":"CVE-2023-0286","url":"https://www.cve.org/CVERecord?id=CVE-2023-0286"},{"name":"CVE-2024-45285","url":"https://www.cve.org/CVERecord?id=CVE-2024-45285"},{"name":"CVE-2024-45286","url":"https://www.cve.org/CVERecord?id=CVE-2024-45286"},{"name":"CVE-2024-44116","url":"https://www.cve.org/CVERecord?id=CVE-2024-44116"},{"name":"CVE-2024-44113","url":"https://www.cve.org/CVERecord?id=CVE-2024-44113"},{"name":"CVE-2024-41729","url":"https://www.cve.org/CVERecord?id=CVE-2024-41729"},{"name":"CVE-2024-44112","url":"https://www.cve.org/CVERecord?id=CVE-2024-44112"},{"name":"CVE-2024-41728","url":"https://www.cve.org/CVERecord?id=CVE-2024-41728"},{"name":"CVE-2024-42371","url":"https://www.cve.org/CVERecord?id=CVE-2024-42371"},{"name":"CVE-2024-42380","url":"https://www.cve.org/CVERecord?id=CVE-2024-42380"},{"name":"CVE-2024-45280","url":"https://www.cve.org/CVERecord?id=CVE-2024-45280"},{"name":"CVE-2024-45283","url":"https://www.cve.org/CVERecord?id=CVE-2024-45283"},{"name":"CVE-2013-3587","url":"https://www.cve.org/CVERecord?id=CVE-2013-3587"},{"name":"CVE-2022-0778","url":"https://www.cve.org/CVERecord?id=CVE-2022-0778"},{"name":"CVE-2024-45284","url":"https://www.cve.org/CVERecord?id=CVE-2024-45284"},{"name":"CVE-2024-44114","url":"https://www.cve.org/CVERecord?id=CVE-2024-44114"},{"name":"CVE-2024-41730","url":"https://www.cve.org/CVERecord?id=CVE-2024-41730"},{"name":"CVE-2024-44121","url":"https://www.cve.org/CVERecord?id=CVE-2024-44121"},{"name":"CVE-2024-42378","url":"https://www.cve.org/CVERecord?id=CVE-2024-42378"},{"name":"CVE-2024-44120","url":"https://www.cve.org/CVERecord?id=CVE-2024-44120"}],"links":[],"reference":"CERTFR-2024-AVI-0754","revisions":[{"description":"Version initiale","revision_date":"2024-09-10T00:00:00.000000"}],"risks":[{"description":"Injection de code indirecte \u00e0 distance (XSS)"},{"description":"Non sp\u00e9cifi\u00e9 par l'\u00e9diteur"},{"description":"Contournement de la politique de s\u00e9curit\u00e9"},{"description":"Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"}],"summary":"De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d'entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.","title":"Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP","vendor_advisories":[{"published_at":"2024-09-09","title":"Bulletin de s\u00e9curit\u00e9 SAP","url":"https://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2024.html"}]}