CVE-2024-41730 — Missing Authentication check in SAP BusinessObjects Business Intelligence Platform

CVE-2024-41730

Missing Authentication check in SAP BusinessObjects Business Intelligence Platform PUBLISHED

Description (CNA)

In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token using a REST endpoint. The attacker can fully compromise the system resulting in High impact on confidentiality, integrity and availability.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP BusinessObjects Business Intelligence Platform	affected ENTERPRISE 430; affected 440

CWE

CWE-862

References

https://me.sap.com/notes/3479478
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.