CVE-2024-37180

Description

Under certain conditions SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to access remote-enabled function module with no further authorization which would otherwise be restricted, the function can be used to read non-sensitive information with low impact on confidentiality of the application.

Reserved 2024-06-04 | Published 2024-07-09 | Updated 2024-08-02 | Assigner sap

Problem types

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Product status

Default status
unaffected

SAP_BASIS 700
affected

SAP_BASIS 701
affected

SAP_BASIS 702
affected

SAP_BASIS 731
affected

SAP_BASIS 740
affected

SAP_BASIS 750
affected

SAP_BASIS 751
affected

SAP_BASIS 752
affected

SAP_BASIS 753
affected

SAP_BASIS 754
affected

SAP_BASIS 755
affected

SAP_BASIS 756
affected

SAP_BASIS 757
affected

SAP_BASIS 758
affected

References

url.sap/sapsecuritypatchday

me.sap.com/notes/3454858

cve.org (CVE-2024-37180)

nvd.nist.gov (CVE-2024-37180)

Download JSON