← Back

CVE-2024-41732

nvd nist
Published: Aug 13, 2024Modified: Jun 17, 2026

JSON object

Loading...
5.4
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.5
Source: NVD

Description

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web applications provided by this server, the attacker might inject CSS code or links into the web application that could allow the attacker to read or modify information. There is no impact on availability of application.

Affected (10)

Sap
1 product
Netweaver Application Server Abap
Configuration A
10 vulnerable
Vulnerable SoftwareAffected Versions
Sap
Netweaver Application Server Abap
Version 755
Netweaver Application Server Abap
Version 756
Netweaver Application Server Abap
Version 757
Netweaver Application Server Abap
Version 758
Netweaver Application Server Abap
Version sap_basis_700
Netweaver Application Server Abap
Version sap_basis_701
Netweaver Application Server Abap
Version sap_basis_702
Netweaver Application Server Abap
Version sap_basis_731
Netweaver Application Server Abap
Version sap_basis_912
Netweaver Application Server Abap
Version sap_ui_754

Related CWEs

CWE-284
Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (2)

Source: cna@sap.com
Permissions Required
Source: cna@sap.com
Vendor Advisory

Timeline

No history available yet.