{"id":"CVE-2024-34692","aliases":["EUVD-2024-34991","GHSA-9r5m-ww6m-rgw3"],"status":"published","title":"[CVE-2024-34692] Unrestricted File upload vulnerability in SAP Enable Now","description":"Due to missing verification of file type or\ncontent, SAP Enable Now allows an authenticated attacker to upload arbitrary\nfiles. These files include executables which might be downloaded and executed\nby the user which could host malware. On successful exploitation an attacker\ncan cause limited impact on confidentiality and Integrity of the application.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0018,"percentile":0.07638,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2024-07-09T04:43:05Z","modified":"2026-06-17T07:33:53Z","products":[{"vendor":"sap","product":"enable_now"},{"vendor":"sap_se","product":"sap enable now"}],"references":[{"url":"https://url.sap/sapsecuritypatchday","tags":["x_transferred","Vendor Advisory"]},{"url":"https://me.sap.com/notes/3476340","tags":["x_transferred","Permissions Required"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34692"},{"url":"https://github.com/advisories/GHSA-9r5m-ww6m-rgw3"}],"sources":{"cve":[{"id":"CVE-2024-34692","title":"[CVE-2024-34692] Unrestricted File upload vulnerability in SAP Enable Now","description":"Due to missing verification of file type or\ncontent, SAP Enable Now allows an authenticated attacker to upload arbitrary\nfiles. These files include executables which might be downloaded and executed\nby the user which could host malware. On successful exploitation an attacker\ncan cause limited impact on confidentiality and Integrity of the application.","status":"published","published":"2024-07-09T04:43:05.361Z","modified":"2024-08-02T02:59:22.2Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:34:23.516065Z"}],"euvd":[{"id":"EUVD-2024-34991","description":"Due to missing verification of file type or\ncontent, SAP Enable Now allows an authenticated attacker to upload arbitrary\nfiles. These files include executables which might be downloaded and executed\nby the user which could host malware. On successful exploitation an attacker\ncan cause limited impact on confidentiality and Integrity of the application.","status":"published","published":"2024-07-09T04:43:05Z","modified":"2024-08-02T02:59:22Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T03:50:20.898281Z"}],"ghsa":[{"id":"GHSA-9r5m-ww6m-rgw3","title":"Due to missing verification of file type or\ncontent, SAP Enable Now allows an authenticated...","description":"Due to missing verification of file type or\ncontent, SAP Enable Now allows an authenticated attacker to upload arbitrary\nfiles. These files include executables which might be downloaded and executed\nby the user which could host malware. On successful exploitation an attacker\ncan cause limited impact on confidentiality and Integrity of the application.","status":"published","published":"2024-07-09T06:30:40Z","modified":"2024-07-09T06:30:40Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:57:39.292896Z"}],"nvd":[{"id":"CVE-2024-34692","description":"Due to missing verification of file type or\ncontent, SAP Enable Now allows an authenticated attacker to upload arbitrary\nfiles. These files include executables which might be downloaded and executed\nby the user which could host malware. On successful exploitation an attacker\ncan cause limited impact on confidentiality and Integrity of the application.","status":"published","published":"2024-07-09T05:15:11.183Z","modified":"2026-06-17T07:33:53.33Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:10:10.545705Z"}]}}