Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-25642

Due to improper validation of certificate in SAP Cloud Connector - version 2.0, attacker can impersonate the genuine servers to interact with SCC breaking the mutual authentication. Hence, the attacker can intercept the request to view/modify sensitive information. There is no impact on the availability of the system.

Published

2024-02-13T03:15:09.613

Last Modified

2025-02-13T18:17:14.807

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.4 (HIGH)

Weaknesses

Type: Secondary
CWE-295

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	sap	cloud_connector	2.0	Yes

References

http://seclists.org/fulldisclosure/2024/May/26 Mailing List, Third Party Advisory ([email protected])
https://me.sap.com/notes/3424610 Permissions Required ([email protected])
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory ([email protected])
http://seclists.org/fulldisclosure/2024/May/26 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://me.sap.com/notes/3424610 Permissions Required (af854a3a-2127-422b-91ae-364da2661108)
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)