CVE-2024-24743: 
SAP NetWeaver Application Server Java vulnerability analysis and mitigation

SAP NetWeaver AS Java (CAF - Guided Procedures) version 7.50 contains a vulnerability that was discovered and assigned CVE-2024-24743. The vulnerability was initially recorded on January 29, 2024, affecting the Guided Procedures component of SAP NetWeaver Application Server Java (CVE Details).

The vulnerability allows an unauthenticated attacker to submit malicious requests containing crafted XML files over the network. When these files are parsed by the system, they can enable access to sensitive files and data. However, the vulnerability has built-in expansion limits that prevent availability impacts, and the attacker cannot modify the accessed files (CVE Details).

The primary impact of this vulnerability is the potential unauthorized access to sensitive files and data within the SAP NetWeaver AS Java system. While the attacker can read sensitive information, the vulnerability does not allow for modification of the accessed files (CERT-FR).

SAP has addressed this vulnerability through their security update process. Users are advised to refer to SAP Security Note 3426111 for detailed mitigation instructions (CERT-FR).