CVE-2024-37180

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Under certain conditions SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to access remote-enabled function module with no further authorization which would otherwise be restricted, the function can be used to read non-sensitive information with low impact on confidentiality of the application.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
SAP_SE	SAP NetWeaver Application Server for ABAP and ABAP Platform	SAP_BASIS 700; SAP_BASIS 701; SAP_BASIS 702; SAP_BASIS 731; SAP_BASIS 740; SAP_BASIS 750; SAP_BASIS 751; SAP_BASIS 752; SAP_BASIS 753; SAP_BASIS 754; SAP_BASIS 755; SAP_BASIS 756; SAP_BASIS 757; SAP_BASIS 758

References

https://me.sap.com/notes/3454858Permissions Required
https://url.sap/sapsecuritypatchdayPatch
https://me.sap.com/notes/3454858Permissions Required
https://url.sap/sapsecuritypatchdayPatch

Timeline

Published: Jul 9, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-371812.6Time-of-check time-of-use race condition in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user to CVE-2024-371826.1Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to CVE-2024-371837.5Plain text credentials and session ID can be captured with a network sniffer.CVE-2024-371847.2A buffer overflow vulnerability exists in the adm.cgi rep_as_bridge() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafte CVE-2024-371859.8in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds write.CVE-2024-371867.2An os command injection vulnerability exists in the adm.cgi set_ledonoff() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially c CVE-2024-371875.7Advantech ADAM-5550 share user credentials with a low level of encryption, consisting of base 64 encoding.CVE-2024-37198.8A vulnerability, which was classified as critical, was found in Campcodes House Rental Management System 1.0. This affects an unknown part o CVE-2024-371988.8Cross-Site Request Forgery (CSRF) vulnerability in blazethemes Digital Newspaper.This issue affects Digital Newspaper: from n/a through 1.1.CVE-2024-371996.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kriesi.At Enfold allows Reflect CVE-2024-37206.3A vulnerability has been found in Tianwell Fire Intelligent Command Platform 1.1.1.1 and classified as critical. This vulnerability affects CVE-2024-372014.3Missing Authorization vulnerability in javmah Woocommerce Customers Order History allows Exploiting Incorrectly Configured Access Control Se