« Volver al listado

CVE-2024-41732

Estado: AnalizadaMedia (5.4)—
Detalles técnicos trazas, registros y código del informe original
SAP NetWeaver Application Server ABAP allows
  an unauthenticated attacker to craft a URL link that could bypass allowlist
  controls. Depending on the web applications provided by this server, the
  attacker might inject CSS code or links into the web application that could
  allow the attacker to read or modify information. There is no impact on
  availability of application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Netweaver Application Server Abap

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-41732",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-41732",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-13T13:02:08.351578Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.7,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP NetWeaver Application Server ABAP",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_UI 754"
            },
            {
              "status": "affected",
              "version": "755"
            },
            {
              "status": "affected",
              "version": "756"
            },
            {
              "status": "affected",
              "version": "757"
            },
            {
              "status": "affected",
              "version": "758"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 700"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 701"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 702"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 731"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 912"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-08-13T04:15:08.637",
  "references": [
    {
      "url": "https://me.sap.com/notes/3468102",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP NetWeaver Application Server ABAP allows\n  an unauthenticated attacker to craft a URL link that could bypass allowlist\n  controls. Depending on the web applications provided by this server, the\n  attacker might inject CSS code or links into the web application that could\n  allow the attacker to read or modify information. There is no impact on\n  availability of application."
    },
    {
      "lang": "es",
      "value": "SAP NetWeaver Application Server ABAP permite a un atacante no autenticado crear un enlace URL que podría eludir los controles de la lista de permitidos. Dependiendo de las aplicaciones web proporcionadas por este servidor, el atacante podría inyectar código CSS o enlaces en la aplicación web que podrían permitirle leer o modificar información. No hay ningún impacto en la disponibilidad de la aplicación."
    }
  ],
  "lastModified": "2026-06-17T07:48:09.047",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B8D3EA0-28E6-4333-8C67-B9D3775EB9BC"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:756:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72491771-4492-4902-9F0C-CE6A60BAA705"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:757:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "421A5354-F764-402B-A3A4-2D746EACEB46"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:758:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "48DFFD36-0A4A-417F-9BC5-77FD4152B637"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:sap_basis_700:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB7909F4-1D66-4C4F-95F3-34ACB0190DB8"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:sap_basis_701:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8310EBA-2438-427F-80C2-BE151E35D97D"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:sap_basis_702:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "732E155D-C866-4F0E-BC86-037B94308B7D"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:sap_basis_731:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "035EDBAC-C29B-49DB-ACEE-CA64750E7290"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:sap_basis_912:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1CC51692-5E94-4678-99B0-4EC1D633DDF8"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:sap_ui_754:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D1C94D7F-EF14-41AB-9A6A-EB99E40AD99A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}