{"id":"CVE-2024-34689","aliases":["EUVD-2024-34988","GHSA-hx7c-3fpv-rgpx"],"status":"published","title":"[CVE-2024-34689] Server-Side Request Forgery in SAP Business Workflow (WebFlow Services)","description":"WebFlow Services of SAP Business Workflow allows\nan authenticated attacker to enumerate accessible HTTP endpoints in the\ninternal network by specially crafting HTTP requests. On successful\nexploitation this can result in information disclosure. It has no impact on\nintegrity and availability of the application.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00353,"percentile":0.29243,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2024-07-09T04:18:21Z","modified":"2026-06-17T07:33:52Z","products":[{"vendor":"sap","product":"business_workflow"},{"vendor":"sap","product":"sap_basis"},{"vendor":"sap_se","product":"sap business workflow (webflow services)"},{"vendor":"sap_se","product":"sap_business_workflow_\\(webflow_services\\)"}],"references":[{"url":"https://url.sap/sapsecuritypatchday","tags":["x_transferred","Vendor Advisory"]},{"url":"https://me.sap.com/notes/3458789","tags":["x_transferred","Permissions Required"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34689"},{"url":"https://github.com/advisories/GHSA-hx7c-3fpv-rgpx"}],"sources":{"cve":[{"id":"CVE-2024-34689","title":"[CVE-2024-34689] Server-Side Request Forgery in SAP Business Workflow (WebFlow Services)","description":"WebFlow Services of SAP Business Workflow allows\nan authenticated attacker to enumerate accessible HTTP endpoints in the\ninternal network by specially crafting HTTP requests. On successful\nexploitation this can result in information disclosure. It has no impact on\nintegrity and availability of the application.","status":"published","published":"2024-07-09T04:18:21.258Z","modified":"2024-08-02T02:59:22.63Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:34:23.516065Z"}],"euvd":[{"id":"EUVD-2024-34988","description":"WebFlow Services of SAP Business Workflow allows\nan authenticated attacker to enumerate accessible HTTP endpoints in the\ninternal network by specially crafting HTTP requests. On successful\nexploitation this can result in information disclosure. It has no impact on\nintegrity and availability of the application.","status":"published","published":"2024-07-09T04:18:21Z","modified":"2024-08-02T02:59:22Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:20.898281Z"}],"ghsa":[{"id":"GHSA-hx7c-3fpv-rgpx","title":"WebFlow Services of SAP Business Workflow allows\nan authenticated attacker to enumerate...","description":"WebFlow Services of SAP Business Workflow allows\nan authenticated attacker to enumerate accessible HTTP endpoints in the\ninternal network by specially crafting HTTP requests. On successful\nexploitation this can result in information disclosure. It has no impact on\nintegrity and availability of the application.","status":"published","published":"2024-07-09T06:30:40Z","modified":"2024-07-09T06:30:40Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:57:39.292896Z"}],"nvd":[{"id":"CVE-2024-34689","description":"WebFlow Services of SAP Business Workflow allows\nan authenticated attacker to enumerate accessible HTTP endpoints in the\ninternal network by specially crafting HTTP requests. On successful\nexploitation this can result in information disclosure. It has no impact on\nintegrity and availability of the application.","status":"published","published":"2024-07-09T05:15:10.873Z","modified":"2026-06-17T07:33:52.963Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:10:10.545705Z"}]}}