{"id":"CVE-2024-41734","aliases":["EUVD-2024-39177","GHSA-45m2-f9mw-223r"],"status":"published","title":"Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform","description":"Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an underlying transaction, which leads to disclosure of user related information. There is no impact on integrity or availability.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00262,"percentile":0.18083,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2024-08-13T04:18:03Z","modified":"2026-06-17T07:48:09Z","products":[{"vendor":"sap","product":"netweaver_application_server_abap"},{"vendor":"sap_se","product":"sap netweaver application server abap and abap platform"}],"references":[{"url":"https://me.sap.com/notes/3494349","tags":["Permissions Required"]},{"url":"https://url.sap/sapsecuritypatchday","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41734"},{"url":"https://github.com/advisories/GHSA-45m2-f9mw-223r"}],"sources":{"cve":[{"id":"CVE-2024-41734","title":"Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform","description":"Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an underlying transaction, which leads to disclosure of user related information. There is no impact on integrity or availability.","status":"published","published":"2024-08-13T04:18:03.596Z","modified":"2024-08-13T14:38:41.935Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:34:04.00829Z"}],"euvd":[{"id":"EUVD-2024-39177","description":"Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an underlying transaction, which leads to disclosure of user related information. There is no impact on integrity or availability.","status":"published","published":"2024-08-13T04:18:03Z","modified":"2024-08-13T14:38:41Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:56:19.192984Z"}],"ghsa":[{"id":"GHSA-45m2-f9mw-223r","title":"Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an...","description":"Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an underlying transaction, which leads to disclosure of user related information. There is no impact on integrity or availability.","status":"published","published":"2024-08-13T06:30:48Z","modified":"2024-08-13T06:31:44Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:57:56.424434Z"}],"nvd":[{"id":"CVE-2024-41734","description":"Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an underlying transaction, which leads to disclosure of user related information. There is no impact on integrity or availability.","status":"published","published":"2024-08-13T05:15:13.587Z","modified":"2026-06-17T07:48:09.38Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:10:18.563492Z"}]}}