CVE-2024-39598

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

SAP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
SAP_SE	SAP CRM WebClient UI	S4FND 102; S4FND 103; S4FND 104; S4FND 105; S4FND 106; S4FND 107; S4FND 108; WEBCUIF 701; WEBCUIF 731; WEBCUIF 746; WEBCUIF 747; WEBCUIF 748; WEBCUIF 800; WEBCUIF 801

References

https://me.sap.com/notes/3467377Permissions Required
https://url.sap/sapsecuritypatchdayVendor Advisory
https://me.sap.com/notes/3467377Permissions Required
https://url.sap/sapsecuritypatchdayVendor Advisory

Timeline

Published: Jul 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-395994.7Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured CVE-2024-396004.2Under certain conditions, the memory of SAP GUI for Windows contains the password used to log on to an SAP system, which might allow an atta CVE-2024-396016.5A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1 CVE-2024-396029.1An external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially cra CVE-2024-396037.2A stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic_mesh() functionality of Wavlink AC3000 M33A8.V5030.210 CVE-2024-396048.1A command execution vulnerability exists in the update_filter_url.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted CVE-2024-396057.8If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer over CVE-2024-396066.1Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an un CVE-2024-396076.8OS command injection vulnerability exists in ELECOM wireless LAN routers. A specially crafted request may be sent to the affected product by CVE-2024-396089.8A firmware update vulnerability exists in the login.cgi functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request CVE-2024-396096.7Improper Access Control in UEFI firmware for some Intel(R) Server Board M70KLP may allow a privileged user to potentially enable escalation CVE-2024-39615.3The ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages plugin for WordPress is vulnerable to unauthorized modific