CVE-2024-39593

MediumCVSS 5.7/10Last modified Jun 17, 2026

Description

SAP Landscape Management allows an authenticated user to read confidential data disclosed by the REST Provider Definition response. Successful exploitation can cause high impact on confidentiality of the managed entities.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
SAP_SESAP Landscape ManagementVCM 3.00

References

Timeline

Published
Jul 9, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-395946.1SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user controlled inputs, resulting in ReflCVE-2024-395955.4SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user-controlled inputs, resulting in StorCVE-2024-395964.3Due to missing authorization checks, SAP Enable Now allows an author to escalate privileges to access information which should otherwise be CVE-2024-395977.2In SAP Commerce, a user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early lCVE-2024-395987.7SAP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by speciallCVE-2024-395994.7Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured CVE-2024-396004.2Under certain conditions, the memory of SAP GUI for Windows contains the password used to log on to an SAP system, which might allow an attaCVE-2024-396016.5A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1CVE-2024-396029.1An external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially craCVE-2024-396037.2A stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic_mesh() functionality of Wavlink AC3000 M33A8.V5030.210CVE-2024-396048.1A command execution vulnerability exists in the update_filter_url.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially craftedCVE-2024-396057.8If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer over