Products
SAP BEx Analyzer
Source
cna@sap.com
Tags
CVE-2024-41729 details
Published : Sept. 10, 2024, 3:15 a.m.
Last Modified : Sept. 10, 2024, 12:09 p.m.
Last Modified : Sept. 10, 2024, 12:09 p.m.
Description
Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limited impact on confidentiality of the application.
CVSS Score
1 | 2 | 3 | 4.3 | 5 | 6 | 7 | 8 | 9 | 10 |
---|
Weakness
Weakness | Name | Description |
---|---|---|
CWE-359 | Exposure of Private Personal Information to an Unauthorized Actor | The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected. |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
Base Score
4.3
Exploitability Score
2.8
Impact Score
1.4
Base Severity
MEDIUM
Vector String : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
URL | Source |
---|---|
https://me.sap.com/notes/3481588 | cna@sap.com |
https://url.sap/sapsecuritypatchday | cna@sap.com |
This website uses the NVD API, but is not approved or certified by it.