CVE-2024-41728

LOW

SAP NetWeaver Application Server ABAP - Missing Authorization Check for Package Object Access

Title source: llm

Description

Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects contained in a package. This causes an impact on confidentiality, as this attacker would otherwise not have access to view these objects.

References (2)

Core 2

Core References

Permissions Required

https://me.sap.com/notes/3496410

Patch

https://url.sap/sapsecuritypatchday

Scores

CVSS v3 2.7

EPSS 0.0009

EPSS Percentile 24.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (15)

sap/netweaver_application_server_abap 700

sap/netweaver_application_server_abap 701

sap/netweaver_application_server_abap 702

sap/netweaver_application_server_abap 731

sap/netweaver_application_server_abap 740

sap/netweaver_application_server_abap 750

sap/netweaver_application_server_abap 751

sap/netweaver_application_server_abap 752

sap/netweaver_application_server_abap 753

sap/netweaver_application_server_abap 754

... and 5 more

Published Sep 10, 2024

Tracked Since Feb 18, 2026