CVE-2024-28163

MEDIUM

SAP Netweaver Process Integration - Incorrect Permission Assignment

Title source: rule

Description

Under certain conditions, Support Web Pages of SAP NetWeaver Process Integration (PI) - versions 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality with no impact on Integrity and Availability of the application.

References (2)

Core 2

Core References

Permissions Required

https://me.sap.com/notes/3434192

Vendor Advisory

https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364

Scores

CVSS v3 5.3

EPSS 0.0029

EPSS Percentile 52.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-732

Status published

Products (1)

sap/netweaver_process_integration 7.50

Published Mar 12, 2024

Tracked Since Feb 18, 2026