Lucene search

SapCVE-2024-41730

HistoryAug 13, 2024 - 4:15 a.m.

CVE-2024-41730

2024-08-1304:15:08

CWE-862

sap

web.nvd.nist.gov

cve-2024-41730

sap businessobjects

sso

enterprise authentication

rest endpoint

unauthorized access

system compromise

confidentiality

integrity

availability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.001

Percentile

39.7%

JSON

In SAP BusinessObjects Business Intelligence
Platform, if Single Signed On is enabled on Enterprise authentication, an
unauthorized user can get a logon token using a REST endpoint. The attacker can
fully compromise the system resulting in High impact on confidentiality,
integrity and availability.

Affected configurations

Nvd

Node

sapbusiness_objects_business_intelligence_platformMatchenterprise_430

sapbusiness_objects_business_intelligence_platformMatchenterprise_440

VendorProductVersionCPE
sapbusiness_objects_business_intelligence_platformenterprise_430cpe:2.3:a:sap:business_objects_business_intelligence_platform:enterprise_430:*:*:*:*:*:*:*
sapbusiness_objects_business_intelligence_platformenterprise_440cpe:2.3:a:sap:business_objects_business_intelligence_platform:enterprise_440:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	business_objects_business_intelligence_platform	enterprise_430	cpe:2.3:a:sap:business_objects_business_intelligence_platform:enterprise_430:::::::*
sap	business_objects_business_intelligence_platform	enterprise_440	cpe:2.3:a:sap:business_objects_business_intelligence_platform:enterprise_440:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP BusinessObjects Business Intelligence Platform",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "ENTERPRISE 430"
      },
      {
        "status": "affected",
        "version": "440"
      }
    ]
  }
]

References

me.sap.com/notes/3479478

url.sap/sapsecuritypatchday

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.001

Percentile

39.7%

JSON

Related for CVE-2024-41730