SAP Application Interface Framework vulnerabilities

4 CVEs affecting SAP Application Interface Framework, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-21737, published 2024-01-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-21737, published 2024-01-09. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. In SAP Application Interface Framework File Adapter - version 702, a high privilege user can use a function module to traverse through various layers and execute OS commands directly. By this, such…
CVE-2023-29111, published 2023-04-11. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. The SAP AIF (ODATA service) - versions 755, 756, discloses more detailed information than is required. An authorized attacker can use the collected information possibly to exploit the component. As a…
CVE-2023-29110, published 2023-04-11. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. The SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows the usage HTML tags. An authorized…
CVE-2023-29109, published 2023-04-11. Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days. The SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows an Excel formula injection. An…