{"id":"CVE-2024-41737","state":"PUBLISHED","title":"Server-Side Request Forgery (SSRF) in SAP CRM ABAP (Insights Management)","description":"SAP CRM ABAP (Insights\nManagement) allows an authenticated attacker to enumerate HTTP endpoints in the\ninternal network by specially crafting HTTP requests. On successful\nexploitation this can result in information disclosure. It has no impact on\nintegrity and availability of the application.","publishedAt":"2024-08-13T03:55:04.128Z","updatedAt":"2024-08-14T16:43:20.026Z","severity":{"score":5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","source":"sap"},"assigner":"sap","products":["SAP_SE SAP CRM ABAP (Insights Management)"],"affected":[{"vendor":"SAP_SE","product":"SAP CRM ABAP (Insights Management)","defaultStatus":"unaffected","versions":[{"version":"BBPCRM 700","status":"affected"},{"version":"701","status":"affected"},{"version":"702","status":"affected"},{"version":"712","status":"affected"},{"version":"713","status":"affected"},{"version":"714","status":"affected"}]}],"references":["https://me.sap.com/notes/3487537","https://url.sap/sapsecuritypatchday"],"weaknesses":["CWE-918"],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/41xxx/CVE-2024-41737.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-41737","state":"PUBLISHED","datePublished":"2024-08-13T03:55:04.128Z","dateUpdated":"2024-08-14T16:43:20.026Z","assignerShortName":"sap","assignerOrgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateReserved":"2024-07-22T08:06:52.677Z"},"containers":{"cna":{"title":"Server-Side Request Forgery (SSRF) in SAP CRM ABAP (Insights Management)","descriptions":[{"lang":"en","value":"SAP CRM ABAP (Insights\nManagement) allows an authenticated attacker to enumerate HTTP endpoints in the\ninternal network by specially crafting HTTP requests. On successful\nexploitation this can result in information disclosure. It has no impact on\nintegrity and availability of the application."}],"affected":[{"vendor":"SAP_SE","product":"SAP CRM ABAP (Insights Management)","defaultStatus":"unaffected","versions":[{"version":"BBPCRM 700","status":"affected"},{"version":"701","status":"affected"},{"version":"702","status":"affected"},{"version":"712","status":"affected"},{"version":"713","status":"affected"},{"version":"714","status":"affected"}]}],"references":[{"url":"https://me.sap.com/notes/3487537"},{"url":"https://url.sap/sapsecuritypatchday"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","description":"CWE-918: Server-Side Request Forgery","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"sap","orgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateUpdated":"2024-08-13T03:55:04.128Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-14T16:43:03.220645Z","id":"CVE-2024-41737","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-14T16:43:20.026Z"}}]}}}