« Volver al listado

CVE-2024-41729

Estado: AplazadaMedia (4.3)—

Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limited impact on confidentiality of the application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

SAP — BEX AnalyzerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-41729",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-41729",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-10T14:05:27.673500Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP NetWeaver BW (BEx Analyzer)",
          "versions": [
            {
              "status": "affected",
              "version": "DW4CORE 200"
            },
            {
              "status": "affected",
              "version": "DW4CORE 300"
            },
            {
              "status": "affected",
              "version": "DW4CORE 400"
            },
            {
              "status": "affected",
              "version": "SAP_BW 700"
            },
            {
              "status": "affected",
              "version": "SAP_BW 701"
            },
            {
              "status": "affected",
              "version": "SAP_BW 702"
            },
            {
              "status": "affected",
              "version": "SAP_BW 731"
            },
            {
              "status": "affected",
              "version": "SAP_BW 740"
            },
            {
              "status": "affected",
              "version": "SAP_BW 750"
            },
            {
              "status": "affected",
              "version": "SAP_BW 751"
            },
            {
              "status": "affected",
              "version": "SAP_BW 752"
            },
            {
              "status": "affected",
              "version": "SAP_BW 753"
            },
            {
              "status": "affected",
              "version": "SAP_BW 754"
            },
            {
              "status": "affected",
              "version": "SAP_BW 755"
            },
            {
              "status": "affected",
              "version": "SAP_BW 756"
            },
            {
              "status": "affected",
              "version": "SAP_BW 757"
            },
            {
              "status": "affected",
              "version": "SAP_BW 758"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-09-10T03:15:02.033",
  "references": [
    {
      "url": "https://me.sap.com/notes/3481588",
      "source": "cna@sap.com"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "source": "cna@sap.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-359"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limited impact on confidentiality of the application."
    },
    {
      "lang": "es",
      "value": "Debido a la falta de comprobaciones de autorización, SAP BEx Analyzer permite que un atacante autenticado acceda a información a través de la red que, de otro modo, estaría restringida. Si la explotación es exitosa, el atacante puede enumerar información, lo que provoca un impacto limitado en la confidencialidad de la aplicación."
    }
  ],
  "lastModified": "2026-06-17T07:48:08.700",
  "sourceIdentifier": "cna@sap.com"
}