CVE-2024-28164

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

SAP NetWeaver AS Java (CAF - Guided Procedures) allows an unauthenticated user to access non-sensitive information about the server which would otherwise be restricted causing low impact on confidentiality of the application.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
SAP_SE	SAP NetWeaver AS Java	GP-CORE 7.5
sap	netweaver	7.50

References

https://me.sap.com/notes/3425571Permissions Required
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.htmlVendor Advisory
https://me.sap.com/notes/3425571Permissions Required
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.htmlVendor Advisory

Timeline

Published: Jun 11, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-281659.3SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendo CVE-2024-281664.3SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that coul CVE-2024-281676.5SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of pr CVE-2024-281687.5Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graph CVE-2024-281695.4Cleartext transmission of sensitive information for some BigDL software maintained by Intel(R) before version 2.5.0 may allow an authenticat CVE-2024-28176.5A vulnerability, which was classified as problematic, has been found in Tenda AC15 15.03.05.18. Affected by this issue is the function fromS CVE-2024-281705.5Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable information disclosu CVE-2024-281718.1It is possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exis CVE-2024-281727.3Uncontrolled search path for some Intel(R) Trace Analyzer and Collector software before version 2022.1 may allow an authenticated user to po CVE-2024-281734.3In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed CVE-2024-281745.8In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperly CVE-2024-281755.4Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Due to the improper URL protocols filtering of links specified in