CVE-2024-41728

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects contained in a package. This causes an impact on confidentiality, as this attacker would otherwise not have access to view these objects.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
SAP_SE	SAP NetWeaver Application Server for ABAP and ABAP Platform	700; 701; 702; 731; 740; 750; 751; 752; 753; 754; 755; 756; 757; 758; 912

References

https://me.sap.com/notes/3496410Permissions Required
https://url.sap/sapsecuritypatchdayPatch

Timeline

Published: Sep 10, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-417294.3Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is other CVE-2024-41739.8A vulnerability in Brocade SANnav exposes Kafka in the wan interface. The vulnerability could allow an unauthenticated attacker to perform CVE-2024-417309.8In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can CVE-2024-417314.3SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be CVE-2024-417325.4SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depen CVE-2024-417335.3In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacke CVE-2024-417344.3Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an under CVE-2024-417355.4SAP Commerce Backoffice does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability causing l CVE-2024-417364.3Under certain conditions SAP Permit to Work allows an authenticated attacker to access information which would otherwise be restricted causi CVE-2024-417375.0SAP CRM ABAP (Insights Management) allows an authenticated attacker to enumerate HTTP endpoints in the internal network by specially craftin CVE-2024-417385.9IBM TXSeries for Multiplatforms 10.1 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to CVE-2024-417398.8IBM Cognos Dashboards 4.0.7 and 5.0.0 on Cloud Pak for Data could allow a remote attacker to perform unauthorized actions due to dependency