Vulnerability · Published Sep 10, 2024 · Assigned by sap
CVE-2024-44113Information Disclosure vulnerability in the SAP Business Warehouse (BEx Analyzer)
Medium 4.3
In plain English
A medium-severity missing authorization in SAP Business Warehouse (BEx Analyzer) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 81.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Due to missing authorization checks, SAP Business Warehouse (BEx Analyzer) allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limited impact on confidentiality of the application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP Business Warehouse (BEx Analyzer) | DW4CORE 200DW4CORE 300DW4CORE 400SAP_BW 700SAP_BW 701SAP_BW 702SAP_BW 731SAP_BW 740 |
Weakness: CWE-359, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N