CVE-2024-42380

Summary

The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along with all the specific data of each node. Usernames can be enumerated by exploiting vulnerability. There is low impact on confidentiality of the application.

Affected Software

VendorProductVersion RangeStatus
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform700affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform701affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform702affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform731affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform740affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform750affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform751affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform752affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform753affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform754affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform755affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform756affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform757affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform758affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform912affected

Weaknesses

  • CWE-862: CWE-862: Missing Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References