Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository)

published 2024-06-11 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-34987

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits: 0; none known

Due to unrestricted access to the Meta Model Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks on the application, which may prevent legitimate users from accessing it. This can result in no impact on confidentiality and integrity but a high impact on the availability of the application.

Patch / fix

links 1

support.sap.com/en/my-support/knowledge-base/security-notes-news.html advisory

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 y ago (2024-06-11)

Exploit prediction

0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

SAP_SE SAP NetWeaver AS Java
sap netweaver

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption

References

support.sap.com /en/my-support/knowledge-base/security-notes-news.html
patch, vendor-advisory
me.sap.com /notes/3460407
permissions-required

Sources

CVE List CVE-2024-34688
NVD CVE-2024-34688

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary