CVE-2024-41732: sap netweaver application server abap

csirt@kutim:~/threat-intel/cve/CVE-2024-41732

CVSS 5.4 · Medium EPSS 0,32%

Kerentanan Improper Access Control pada sap netweaver application server abap. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web applications provided by this server, the attacker might inject CSS code or links into the web application that could allow the attacker to read or modify information. There is no impact on availability of application.

Rincian

Terbit di NVD: 13 Agustus 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-284: Improper Access Control
EPSS (30 hari): 0,32% peluang dieksploitasi; lebih tinggi dari 23,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
sap	netweaver application server abap	Versi 755
sap	netweaver application server abap	Versi 756
sap	netweaver application server abap	Versi 757
sap	netweaver application server abap	Versi 758
sap	netweaver application server abap	Versi sap_basis_700
sap	netweaver application server abap	Versi sap_basis_701
sap	netweaver application server abap	Versi sap_basis_702
sap	netweaver application server abap	Versi sap_basis_731
sap	netweaver application server abap	Versi sap_basis_912
sap	netweaver application server abap	Versi sap_ui_754

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://url.sap/sapsecuritypatchday advisory vendor
https://me.sap.com/notes/3468102 permissions required

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.