CVE-2024-44115

Summary

The RFC enabled function module allows a low privileged user to add URLs to any user's workplace favourites. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces, and nodes. There is low impact on integrity of the application

Affected Software

VendorProductVersion RangeStatus
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform700affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform701affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform702affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform731affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform740affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform750affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform751affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform752affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform753affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform754affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform755affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform756affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform757affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform758affected
SAP_SESAP NetWeaver Application Server for ABAP and ABAP Platform912affected

Weaknesses

  • CWE-862: CWE-862: Missing Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References