CVE-2024-42372

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Due to missing authorization check in SAP NetWeaver AS Java (System Landscape Directory) an unauthorized user can read and modify some restricted global SLD configurations causing low impact on confidentiality and integrity of the application.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
SAP_SESAP NetWeaver AS Java (System Landscape Directory)LM-SLD 7.5
sapnetweaver_system_landscape_directory7.5

References

Timeline

Published
Nov 12, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-423735.4SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escaCVE-2024-423748.2BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can reCVE-2024-423754.3SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that coulCVE-2024-423766.5SAP Shared Service Framework does not perform necessary authorization check for an authenticated user, resulting in escalation of privilegesCVE-2024-423774.3SAP shared service framework allows an authenticated non-administrative user to call a remote-enabled function, which will allow them to insCVE-2024-423786.1Due to weak encoding of user-controlled inputs, eProcurement on SAP S/4HANA allows malicious scripts to be executed in the application, poteCVE-2024-42388.8A vulnerability has been found in Tenda AX1806 1.0.0.1 and classified as critical. Affected by this vulnerability is the function formSetDevCVE-2024-423804.3The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along with all the specifCVE-2024-423818.3os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieveCVE-2024-423839.8Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows to write a NULL byte value beyond the memory spCVE-2024-423847.5Integer Overflow or Wraparound vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and prCVE-2024-423857.0Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if t