{"id":"CVE-2024-44116","state":"PUBLISHED","title":"Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform","description":"The RFC enabled function module allows a low privileged user to add any workbook to any user's workplace favourites. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces. There is low impact on integrity of the application.","publishedAt":"2024-09-10T03:11:05.878Z","updatedAt":"2024-09-10T13:27:43.993Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","source":"sap"},"assigner":"sap","products":["SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform"],"affected":[{"vendor":"SAP_SE","product":"SAP NetWeaver Application Server for ABAP and ABAP Platform","defaultStatus":"unaffected","versions":[{"version":"700","status":"affected"},{"version":"701","status":"affected"},{"version":"702","status":"affected"},{"version":"731","status":"affected"},{"version":"740","status":"affected"},{"version":"750","status":"affected"},{"version":"751","status":"affected"},{"version":"752","status":"affected"},{"version":"753","status":"affected"},{"version":"754","status":"affected"},{"version":"755","status":"affected"},{"version":"756","status":"affected"},{"version":"757","status":"affected"},{"version":"758","status":"affected"},{"version":"912","status":"affected"}]}],"references":["https://me.sap.com/notes/3488039","https://url.sap/sapsecuritypatchday"],"weaknesses":["CWE-862"],"ingestedAt":"2026-10-29T20:07:47.831Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/44xxx/CVE-2024-44116.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-44116","state":"PUBLISHED","datePublished":"2024-09-10T03:11:05.878Z","dateUpdated":"2024-09-10T13:27:43.993Z","assignerShortName":"sap","assignerOrgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateReserved":"2024-08-20T20:22:59.937Z"},"containers":{"cna":{"title":"Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform","descriptions":[{"lang":"en","value":"The RFC enabled function module allows a low privileged user to add any workbook to any user's workplace favourites. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces. There is low impact on integrity of the application."}],"affected":[{"vendor":"SAP_SE","product":"SAP NetWeaver Application Server for ABAP and ABAP Platform","defaultStatus":"unaffected","versions":[{"version":"700","status":"affected"},{"version":"701","status":"affected"},{"version":"702","status":"affected"},{"version":"731","status":"affected"},{"version":"740","status":"affected"},{"version":"750","status":"affected"},{"version":"751","status":"affected"},{"version":"752","status":"affected"},{"version":"753","status":"affected"},{"version":"754","status":"affected"},{"version":"755","status":"affected"},{"version":"756","status":"affected"},{"version":"757","status":"affected"},{"version":"758","status":"affected"},{"version":"912","status":"affected"}]}],"references":[{"url":"https://me.sap.com/notes/3488039"},{"url":"https://url.sap/sapsecuritypatchday"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","description":"CWE-862: Missing Authorization","lang":"eng","type":"CWE"}]}],"providerMetadata":{"shortName":"sap","orgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateUpdated":"2024-09-10T03:11:05.878Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-10T13:27:33.422456Z","id":"CVE-2024-44116","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-10T13:27:43.993Z"}}]}}}