github - ghsa-57v4-696x-63w9

ghsa-57v4-696x-63w9

Vulnerability from github

Published

2024-09-10 03:31

Modified

2024-09-10 03:31

Severity ?

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limited impact on confidentiality of the application.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-41729"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-359"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-10T03:15:02Z",
    "severity": "MODERATE"
  },
  "details": "Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limited impact on confidentiality of the application.",
  "id": "GHSA-57v4-696x-63w9",
  "modified": "2024-09-10T03:31:31Z",
  "published": "2024-09-10T03:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41729"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3481588"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

cve-2024-41729

Vulnerability from cvelistv5

Published

2024-09-10 02:33

Modified

2024-09-10 14:05

Severity ?

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

References

▼	URL	Tags
	https://me.sap.com/notes/3481588
	https://url.sap/sapsecuritypatchday

Impacted products

Vendor

Product

Version

▼

SAP_SE

SAP NetWeaver BW (BEx Analyzer)

Version: DW4CORE 200
Version: DW4CORE 300
Version: DW4CORE 400
Version: SAP_BW 700
Version: SAP_BW 701
Version: SAP_BW 702
Version: SAP_BW 731
Version: SAP_BW 740
Version: SAP_BW 750
Version: SAP_BW 751
Version: SAP_BW 752
Version: SAP_BW 753
Version: SAP_BW 754
Version: SAP_BW 755
Version: SAP_BW 756
Version: SAP_BW 757
Version: SAP_BW 758

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41729",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T14:05:27.673500Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-10T14:05:36.468Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP NetWeaver BW (BEx Analyzer)",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "DW4CORE 200"
            },
            {
              "status": "affected",
              "version": "DW4CORE 300"
            },
            {
              "status": "affected",
              "version": "DW4CORE 400"
            },
            {
              "status": "affected",
              "version": "SAP_BW 700"
            },
            {
              "status": "affected",
              "version": "SAP_BW 701"
            },
            {
              "status": "affected",
              "version": "SAP_BW 702"
            },
            {
              "status": "affected",
              "version": "SAP_BW 731"
            },
            {
              "status": "affected",
              "version": "SAP_BW 740"
            },
            {
              "status": "affected",
              "version": "SAP_BW 750"
            },
            {
              "status": "affected",
              "version": "SAP_BW 751"
            },
            {
              "status": "affected",
              "version": "SAP_BW 752"
            },
            {
              "status": "affected",
              "version": "SAP_BW 753"
            },
            {
              "status": "affected",
              "version": "SAP_BW 754"
            },
            {
              "status": "affected",
              "version": "SAP_BW 755"
            },
            {
              "status": "affected",
              "version": "SAP_BW 756"
            },
            {
              "status": "affected",
              "version": "SAP_BW 757"
            },
            {
              "status": "affected",
              "version": "SAP_BW 758"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDue to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limited impact on confidentiality of the application.\u003c/p\u003e"
            }
          ],
          "value": "Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limited impact on confidentiality of the application."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-359",
              "description": "CWE-359: Exposure of Private Personal Information to an Unauthorized Actor",
              "lang": "eng",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-10T02:33:32.937Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3481588"
        },
        {
          "url": "https://url.sap/sapsecuritypatchday"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Information Disclosure vulnerability in the SAP NetWeaver BW (BEx Analyzer)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2024-41729",
    "datePublished": "2024-09-10T02:33:32.937Z",
    "dateReserved": "2024-07-22T08:06:52.675Z",
    "dateUpdated": "2024-09-10T14:05:36.468Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted