TI-2024-22982 Aliases CVE-2024-34683 GHSA-xmf8-c7vj-6x2r

Unrestricted file upload in SAP Document Builder (HTTP service)

LOW 28CWE-434Published 2024-06-11 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

An authenticated attacker can upload malicious file to SAP Document Builder service. When the victim accesses this file, the attacker is allowed to access, modify, or make the related information unavailable in the victim’s browser.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00241 15th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP Document Builder	S4CORE 100; 101; S4FND 102; 103; 104; 105; 106; 107; 108; SAP_BS_FND 702; 731; 746; 747; 748	—	No fix listed	CNA

SAP Document Builder VendorSAP Affected S4CORE 100; 101; S4FND 102; 103; 104; 105; 106; 107; 108; SAP_BS_FND 702; 731; 746; 747; 748 Fixed in — No fix listed CNA

CPE configurations NVD · 14

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:document_builder:101:::::::*	101	Vulnerable	SAP
cpe:2.3:a:sap:document_builder:103:::::::*	103	Vulnerable	SAP
cpe:2.3:a:sap:document_builder:104:::::::*	104	Vulnerable	SAP
cpe:2.3:a:sap:document_builder:105:::::::*	105	Vulnerable	SAP
cpe:2.3:a:sap:document_builder:106:::::::*	106	Vulnerable	SAP
cpe:2.3:a:sap:document_builder:107:::::::*	107	Vulnerable	SAP
cpe:2.3:a:sap:document_builder:108:::::::*	108	Vulnerable	SAP
cpe:2.3:a:sap:document_builder:731:::::::*	731	Vulnerable	SAP
cpe:2.3:a:sap:document_builder:746:::::::*	746	Vulnerable	SAP
cpe:2.3:a:sap:document_builder:747:::::::*	747	Vulnerable	SAP

cpe:2.3:a:sap:document_builder:101:*:*:*:*:*:*:* Versions 101 Vulnerable ·SAP
cpe:2.3:a:sap:document_builder:103:*:*:*:*:*:*:* Versions 103 Vulnerable ·SAP
cpe:2.3:a:sap:document_builder:104:*:*:*:*:*:*:* Versions 104 Vulnerable ·SAP
cpe:2.3:a:sap:document_builder:105:*:*:*:*:*:*:* Versions 105 Vulnerable ·SAP
cpe:2.3:a:sap:document_builder:106:*:*:*:*:*:*:* Versions 106 Vulnerable ·SAP
cpe:2.3:a:sap:document_builder:107:*:*:*:*:*:*:* Versions 107 Vulnerable ·SAP
cpe:2.3:a:sap:document_builder:108:*:*:*:*:*:*:* Versions 108 Vulnerable ·SAP
cpe:2.3:a:sap:document_builder:731:*:*:*:*:*:*:* Versions 731 Vulnerable ·SAP
cpe:2.3:a:sap:document_builder:746:*:*:*:*:*:*:* Versions 746 Vulnerable ·SAP
cpe:2.3:a:sap:document_builder:747:*:*:*:*:*:*:* Versions 747 Vulnerable ·SAP

Show 4 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:document_builder:748:::::::*	748	Vulnerable	SAP
cpe:2.3:a:sap:document_builder:s4core_100:::::::*	s4core_100	Vulnerable	SAP
cpe:2.3:a:sap:document_builder:s4fnd_102:::::::*	s4fnd_102	Vulnerable	SAP
cpe:2.3:a:sap:document_builder:sap_bs_fnd_702:::::::*	sap_bs_fnd_702	Vulnerable	SAP

cpe:2.3:a:sap:document_builder:748:*:*:*:*:*:*:* Versions 748 Vulnerable ·SAP
cpe:2.3:a:sap:document_builder:s4core_100:*:*:*:*:*:*:* Versions s4core_100 Vulnerable ·SAP
cpe:2.3:a:sap:document_builder:s4fnd_102:*:*:*:*:*:*:* Versions s4fnd_102 Vulnerable ·SAP
cpe:2.3:a:sap:document_builder:sap_bs_fnd_702:*:*:*:*:*:*:* Versions sap_bs_fnd_702 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-34683
2026-10-03 Alias added: GHSA-xmf8-c7vj-6x2r

References

Patch 1

https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html

Other 1

https://me.sap.com/notes/3459379

TI-2024-26521 Missing Authorization check in SAP Document Builder CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences