Log in Start free

Vulnerability · Published Aug 13, 2024 · Assigned by sap

CVE-2024-41732Improper Access Control in SAP Netweaver Application Server ABAP

Medium 4.7

In plain English

A medium-severity improper access control in SAP NetWeaver Application Server ABAP from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.3%top 74.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web applications provided by this server, the attacker might inject CSS code or links into the web application that could allow the attacker to read or modify information. There is no impact on availability of application.

Affected products (as reported)

VendorProductVersions
SAP_SE SAP NetWeaver Application Server ABAP SAP_UI 754755756757758SAP_BASIS 700SAP_BASIS 701SAP_BASIS 702

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

References