{"id":"CVE-2024-39598","aliases":["EUVD-2024-38118","GHSA-v2gf-qrv9-w74g"],"status":"published","title":"[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)","description":"SAP CRM (WebClient UI Framework) allows an\nauthenticated attacker to enumerate accessible HTTP endpoints in the internal\nnetwork by specially crafting HTTP requests. On successful exploitation this\ncan result in information disclosure. It has no impact on integrity and\navailability of the application.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00309,"percentile":0.24057,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2024-07-09T04:04:41Z","modified":"2026-06-17T07:42:18Z","products":[{"vendor":"sap","product":"customer_relationship_management_s4fnd"},{"vendor":"sap","product":"customer_relationship_management_webclient_ui"},{"vendor":"sap_se","product":"sap crm webclient ui"}],"references":[{"url":"https://url.sap/sapsecuritypatchday","tags":["x_transferred","Vendor Advisory"]},{"url":"https://me.sap.com/notes/3467377","tags":["x_transferred","Permissions Required"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39598"},{"url":"https://github.com/advisories/GHSA-v2gf-qrv9-w74g"}],"sources":{"cve":[{"id":"CVE-2024-39598","title":"[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)","description":"SAP CRM (WebClient UI Framework) allows an\nauthenticated attacker to enumerate accessible HTTP endpoints in the internal\nnetwork by specially crafting HTTP requests. On successful exploitation this\ncan result in information disclosure. It has no impact on integrity and\navailability of the application.","status":"published","published":"2024-07-09T04:04:41.283Z","modified":"2024-08-02T04:26:15.953Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:34:18.951288Z"}],"euvd":[{"id":"EUVD-2024-38118","description":"SAP CRM (WebClient UI Framework) allows an\nauthenticated attacker to enumerate accessible HTTP endpoints in the internal\nnetwork by specially crafting HTTP requests. On successful exploitation this\ncan result in information disclosure. It has no impact on integrity and\navailability of the application.","status":"published","published":"2024-07-09T04:04:41Z","modified":"2024-08-02T04:26:15Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:18.019857Z"}],"ghsa":[{"id":"GHSA-v2gf-qrv9-w74g","title":"SAP CRM (WebClient UI Framework) allows an\nauthenticated attacker to enumerate accessible HTTP...","description":"SAP CRM (WebClient UI Framework) allows an\nauthenticated attacker to enumerate accessible HTTP endpoints in the internal\nnetwork by specially crafting HTTP requests. On successful exploitation this\ncan result in information disclosure. It has no impact on integrity and\navailability of the application.","status":"published","published":"2024-07-09T06:30:39Z","modified":"2024-07-09T06:30:39Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:57:39.292896Z"}],"nvd":[{"id":"CVE-2024-39598","description":"SAP CRM (WebClient UI Framework) allows an\nauthenticated attacker to enumerate accessible HTTP endpoints in the internal\nnetwork by specially crafting HTTP requests. On successful exploitation this\ncan result in information disclosure. It has no impact on integrity and\navailability of the application.","status":"published","published":"2024-07-09T04:15:14.86Z","modified":"2026-06-17T07:42:18.25Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:10:10.545705Z"}]}}