CVE-2024-41730

CriticalCVSS 9.8/10Last modified Nov 4, 2026

Description

In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token using a REST endpoint. The attacker can fully compromise the system resulting in High impact on confidentiality, integrity and availability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
SAP_SE	SAP BusinessObjects Business Intelligence Platform	ENTERPRISE 430; 440
sap_se	sap_business_objects_business_intgelligence_platform	440
sap_se	sap_business_objects_business_intgelligence_platform	430

References

https://me.sap.com/notes/3479478Permissions Required
https://url.sap/sapsecuritypatchdayVendor Advisory

Timeline

Published: Aug 13, 2024
Last modified: Nov 4, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-417314.3SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be CVE-2024-417325.4SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depen CVE-2024-417335.3In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacke CVE-2024-417344.3Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an under CVE-2024-417355.4SAP Commerce Backoffice does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability causing l CVE-2024-417364.3Under certain conditions SAP Permit to Work allows an authenticated attacker to access information which would otherwise be restricted causi CVE-2024-417375.0SAP CRM ABAP (Insights Management) allows an authenticated attacker to enumerate HTTP endpoints in the internal network by specially craftin CVE-2024-417385.9IBM TXSeries for Multiplatforms 10.1 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to CVE-2024-417398.8IBM Cognos Dashboards 4.0.7 and 5.0.0 on Cloud Pak for Data could allow a remote attacker to perform unauthorized actions due to dependency CVE-2024-41745.4Cross-Site Scripting (XSS) vulnerability in Hyperion Web Server affecting version 2.0.15. This vulnerability could allow an attacker to exec CVE-2024-417415.3IBM TXSeries for Multiplatforms 10.1 could allow an attacker to determine valid usernames due to an observable timing discrepancy which coul CVE-2024-417427.5IBM TXSeries for Multiplatforms 10.1 is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read