SAP NetWeaver System Landscape Directory vulnerabilities

2 CVEs affecting SAP NetWeaver System Landscape Directory, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-42372, published 2024-11-12.

More from SAP.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-2368, published 2018-03-01. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. SAP NetWeaver System Landscape Directory, LM-CORE 7.10, 7.20, 7.30, 7.31, 7.40, does not perform any authentication checks for functionalities that require user identity.
• CVE-2024-42372, published 2024-11-12. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Due to missing authorization check in SAP NetWeaver AS Java (System Landscape Directory) an unauthorized user can read and modify some restricted global SLD configurations causing low impact on…