CVE-2024-34689
Estado: ModificadaMedia (5)—
WebFlow Services of SAP Business Workflow allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
- Puntuación base: 5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.35%
- Percentil entre todas las CVEs puntuadas: 27
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-918
- CWE-918
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-34689",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-34689",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-07-25T14:21:05.637426Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "cna@sap.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 1.4,
"exploitabilityScore": 3.1
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 1.4,
"exploitabilityScore": 3.1
}
]
},
"affected": [
{
"source": "cna@sap.com",
"affectedData": [
{
"vendor": "SAP_SE",
"product": "SAP Business Workflow (WebFlow Services)",
"versions": [
{
"status": "affected",
"version": "SAP_BASIS 700"
},
{
"status": "affected",
"version": "SAP_BASIS 701"
},
{
"status": "affected",
"version": "SAP_BASIS 702"
},
{
"status": "affected",
"version": "SAP_BASIS 731"
},
{
"status": "affected",
"version": "SAP_BASIS 740"
},
{
"status": "affected",
"version": "SAP_BASIS 750"
},
{
"status": "affected",
"version": "SAP_BASIS 751"
},
{
"status": "affected",
"version": "SAP_BASIS 752"
},
{
"status": "affected",
"version": "SAP_BASIS 753"
},
{
"status": "affected",
"version": "SAP_BASIS 754"
},
{
"status": "affected",
"version": "SAP_BASIS 755"
},
{
"status": "affected",
"version": "SAP_BASIS 756"
},
{
"status": "affected",
"version": "SAP_BASIS 757"
},
{
"status": "affected",
"version": "SAP_BASIS 758"
}
],
"defaultStatus": "unaffected"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"cpes": [
"cpe:2.3:a:sap_se:sap_business_workflow_\\(webflow_services\\):*:*:*:*:*:*:*:*"
],
"vendor": "sap_se",
"product": "sap_business_workflow_\\(webflow_services\\)",
"versions": [
{
"status": "affected",
"version": "SAP_BASIS 700"
},
{
"status": "affected",
"version": "SAP_BASIS 701"
},
{
"status": "affected",
"version": "SAP_BASIS 702"
},
{
"status": "affected",
"version": "SAP_BASIS 731"
},
{
"status": "affected",
"version": "SAP_BASIS 740"
},
{
"status": "affected",
"version": "SAP_BASIS 750"
},
{
"status": "affected",
"version": "SAP_BASIS 751"
},
{
"status": "affected",
"version": "SAP_BASIS 752"
},
{
"status": "affected",
"version": "SAP_BASIS 753"
},
{
"status": "affected",
"version": "SAP_BASIS 754"
},
{
"status": "affected",
"version": "SAP_BASIS 755"
},
{
"status": "affected",
"version": "SAP_BASIS 756"
},
{
"status": "affected",
"version": "SAP_BASIS 757"
},
{
"status": "affected",
"version": "SAP_BASIS 758"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2024-07-09T05:15:10.873",
"references": [
{
"url": "https://me.sap.com/notes/3458789",
"tags": [
"Permissions Required"
],
"source": "cna@sap.com"
},
{
"url": "https://url.sap/sapsecuritypatchday",
"tags": [
"Vendor Advisory"
],
"source": "cna@sap.com"
},
{
"url": "https://me.sap.com/notes/3458789",
"tags": [
"Permissions Required"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://url.sap/sapsecuritypatchday",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "cna@sap.com",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "WebFlow Services of SAP Business Workflow allows\nan authenticated attacker to enumerate accessible HTTP endpoints in the\ninternal network by specially crafting HTTP requests. On successful\nexploitation this can result in information disclosure. It has no impact on\nintegrity and availability of the application."
},
{
"lang": "es",
"value": "WebFlow Services de SAP Business Workflow permite a un atacante autenticado enumerar endpoints HTTP accesibles en la red interna mediante la elaboración especial de solicitudes HTTP. Si se explota con éxito, esto puede dar lugar a la divulgación de información. No tiene ningún impacto en la integridad y disponibilidad de la aplicación."
}
],
"lastModified": "2026-06-17T07:33:52.963",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sap:business_workflow:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1FF29F57-F1C8-4905-B61F-9E72BF689C39"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:700:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "85616273-040E-49CB-8EB6-D2D4D7B603E5"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:701:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C5F2C3A9-DCC0-4FF1-8E68-9EA150E209F6"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:702:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6F774A45-2A9F-4873-A5DC-766D030C8CCD"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:731:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D3A0A2D6-9259-4A35-A236-F4BEE986C1FD"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:740:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "49C3A8E5-FA6A-4EF3-BF50-FD4E1576024F"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:750:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ABA8AB4E-3FE6-46A8-847E-660C5DF6CE71"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:751:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6DA4A6F0-C0F1-42CB-8BBD-7198064733EA"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:752:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8C121CC9-26F6-4103-8EB0-BAFF6B5B5FE8"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:753:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "86086D00-10BF-4C55-8D87-82CCBE468153"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:754:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2F25246A-D9E5-4F0D-B91A-478D4E5570DB"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:755:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0218695F-C4AD-46BF-B176-F10C644A9C2D"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:756:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC9E7C3E-1005-450A-9198-E014C1BAADBC"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:757:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3A177AB1-CC85-46EF-91DF-462096608C9F"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:758:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F7591F81-708C-4285-9BB2-F2B4BDB9759B"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cna@sap.com"
}