CVE-2024-34689
Status: ModifiedMedium (5)—
WebFlow Services of SAP Business Workflow allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
- Base score: 5
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.35%
- Percentile among all scored CVEs: 27
- Score date: 10/6/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (2)
CWEs
- CWE-918
- CWE-918
References
Raw JSON (NVD)
Show
{
"id": "CVE-2024-34689",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-34689",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-07-25T14:21:05.637426Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "cna@sap.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 1.4,
"exploitabilityScore": 3.1
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 1.4,
"exploitabilityScore": 3.1
}
]
},
"affected": [
{
"source": "cna@sap.com",
"affectedData": [
{
"vendor": "SAP_SE",
"product": "SAP Business Workflow (WebFlow Services)",
"versions": [
{
"status": "affected",
"version": "SAP_BASIS 700"
},
{
"status": "affected",
"version": "SAP_BASIS 701"
},
{
"status": "affected",
"version": "SAP_BASIS 702"
},
{
"status": "affected",
"version": "SAP_BASIS 731"
},
{
"status": "affected",
"version": "SAP_BASIS 740"
},
{
"status": "affected",
"version": "SAP_BASIS 750"
},
{
"status": "affected",
"version": "SAP_BASIS 751"
},
{
"status": "affected",
"version": "SAP_BASIS 752"
},
{
"status": "affected",
"version": "SAP_BASIS 753"
},
{
"status": "affected",
"version": "SAP_BASIS 754"
},
{
"status": "affected",
"version": "SAP_BASIS 755"
},
{
"status": "affected",
"version": "SAP_BASIS 756"
},
{
"status": "affected",
"version": "SAP_BASIS 757"
},
{
"status": "affected",
"version": "SAP_BASIS 758"
}
],
"defaultStatus": "unaffected"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"cpes": [
"cpe:2.3:a:sap_se:sap_business_workflow_\\(webflow_services\\):*:*:*:*:*:*:*:*"
],
"vendor": "sap_se",
"product": "sap_business_workflow_\\(webflow_services\\)",
"versions": [
{
"status": "affected",
"version": "SAP_BASIS 700"
},
{
"status": "affected",
"version": "SAP_BASIS 701"
},
{
"status": "affected",
"version": "SAP_BASIS 702"
},
{
"status": "affected",
"version": "SAP_BASIS 731"
},
{
"status": "affected",
"version": "SAP_BASIS 740"
},
{
"status": "affected",
"version": "SAP_BASIS 750"
},
{
"status": "affected",
"version": "SAP_BASIS 751"
},
{
"status": "affected",
"version": "SAP_BASIS 752"
},
{
"status": "affected",
"version": "SAP_BASIS 753"
},
{
"status": "affected",
"version": "SAP_BASIS 754"
},
{
"status": "affected",
"version": "SAP_BASIS 755"
},
{
"status": "affected",
"version": "SAP_BASIS 756"
},
{
"status": "affected",
"version": "SAP_BASIS 757"
},
{
"status": "affected",
"version": "SAP_BASIS 758"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2024-07-09T05:15:10.873",
"references": [
{
"url": "https://me.sap.com/notes/3458789",
"tags": [
"Permissions Required"
],
"source": "cna@sap.com"
},
{
"url": "https://url.sap/sapsecuritypatchday",
"tags": [
"Vendor Advisory"
],
"source": "cna@sap.com"
},
{
"url": "https://me.sap.com/notes/3458789",
"tags": [
"Permissions Required"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://url.sap/sapsecuritypatchday",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "cna@sap.com",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "WebFlow Services of SAP Business Workflow allows\nan authenticated attacker to enumerate accessible HTTP endpoints in the\ninternal network by specially crafting HTTP requests. On successful\nexploitation this can result in information disclosure. It has no impact on\nintegrity and availability of the application."
},
{
"lang": "es",
"value": "WebFlow Services de SAP Business Workflow permite a un atacante autenticado enumerar endpoints HTTP accesibles en la red interna mediante la elaboración especial de solicitudes HTTP. Si se explota con éxito, esto puede dar lugar a la divulgación de información. No tiene ningún impacto en la integridad y disponibilidad de la aplicación."
}
],
"lastModified": "2026-06-17T07:33:52.963",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sap:business_workflow:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1FF29F57-F1C8-4905-B61F-9E72BF689C39"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:700:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "85616273-040E-49CB-8EB6-D2D4D7B603E5"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:701:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C5F2C3A9-DCC0-4FF1-8E68-9EA150E209F6"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:702:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6F774A45-2A9F-4873-A5DC-766D030C8CCD"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:731:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D3A0A2D6-9259-4A35-A236-F4BEE986C1FD"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:740:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "49C3A8E5-FA6A-4EF3-BF50-FD4E1576024F"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:750:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ABA8AB4E-3FE6-46A8-847E-660C5DF6CE71"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:751:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6DA4A6F0-C0F1-42CB-8BBD-7198064733EA"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:752:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8C121CC9-26F6-4103-8EB0-BAFF6B5B5FE8"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:753:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "86086D00-10BF-4C55-8D87-82CCBE468153"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:754:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2F25246A-D9E5-4F0D-B91A-478D4E5570DB"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:755:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0218695F-C4AD-46BF-B176-F10C644A9C2D"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:756:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC9E7C3E-1005-450A-9198-E014C1BAADBC"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:757:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3A177AB1-CC85-46EF-91DF-462096608C9F"
},
{
"criteria": "cpe:2.3:a:sap:sap_basis:758:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F7591F81-708C-4285-9BB2-F2B4BDB9759B"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cna@sap.com"
}