CVE-2024-41732 — Improper Access Control in SAP Netweaver Application Server ABAP

Description (CNA)

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web applications provided by this server, the attacker might inject CSS code or links into the web application that could allow the attacker to read or modify information. There is no impact on availability of application.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP NetWeaver Application Server ABAP	affected SAP_UI 754; affected 755; affected 756; affected 757; affected 758; affected SAP_BASIS 700; affected SAP_BASIS 701; affected SAP_BASIS 702; affected SAP_BASIS 731; affected SAP_BASIS 912

CWE

CWE-284

References

https://me.sap.com/notes/3468102
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.