{"id":"CVE-2024-34683","aliases":["EUVD-2024-34982","GHSA-xmf8-c7vj-6x2r"],"status":"published","title":"Unrestricted file upload in SAP Document Builder (HTTP service)","description":"An authenticated attacker can upload malicious\nfile to SAP Document Builder service. When the victim accesses this file, the\nattacker is allowed to access, modify, or make the related information\nunavailable in the victim’s browser.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00241,"percentile":0.15367,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2024-06-11T02:08:47Z","modified":"2026-06-17T07:33:52Z","products":[{"vendor":"sap","product":"document_builder"},{"vendor":"sap_se","product":"sap document builder"}],"references":[{"url":"https://me.sap.com/notes/3459379","tags":["x_transferred","Permissions Required"]},{"url":"https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html","tags":["x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34683"},{"url":"https://github.com/advisories/GHSA-xmf8-c7vj-6x2r"}],"sources":{"cve":[{"id":"CVE-2024-34683","title":"Unrestricted file upload in SAP Document Builder (HTTP service)","description":"An authenticated attacker can upload malicious\nfile to SAP Document Builder service. When the victim accesses this file, the\nattacker is allowed to access, modify, or make the related information\nunavailable in the victim’s browser.","status":"published","published":"2024-06-11T02:08:47.2Z","modified":"2024-08-02T02:59:22.208Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:34:23.193864Z"}],"euvd":[{"id":"EUVD-2024-34982","description":"An authenticated attacker can upload malicious\nfile to SAP Document Builder service. When the victim accesses this file, the\nattacker is allowed to access, modify, or make the related information\nunavailable in the victim’s browser.","status":"published","published":"2024-06-11T02:08:47Z","modified":"2024-08-02T02:59:22Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T03:50:20.898281Z"}],"ghsa":[{"id":"GHSA-xmf8-c7vj-6x2r","title":"An authenticated attacker can upload malicious\nfile to SAP Document Builder service. When the...","description":"An authenticated attacker can upload malicious\nfile to SAP Document Builder service. When the victim accesses this file, the\nattacker is allowed to access, modify, or make the related information\nunavailable in the victim’s browser.","status":"published","published":"2024-06-11T03:30:59Z","modified":"2024-06-11T03:31:00Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:57:27.150795Z"}],"nvd":[{"id":"CVE-2024-34683","description":"An authenticated attacker can upload malicious\nfile to SAP Document Builder service. When the victim accesses this file, the\nattacker is allowed to access, modify, or make the related information\nunavailable in the victim’s browser.","status":"published","published":"2024-06-11T03:15:10.623Z","modified":"2026-06-17T07:33:52.247Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:10:04.804473Z"}]}}