{"id":"CVE-2024-41737","aliases":["EUVD-2024-39180","GHSA-xxmg-wvh2-q23q"],"status":"published","title":"Server-Side Request Forgery (SSRF) in SAP CRM ABAP (Insights Management)","description":"SAP CRM ABAP (Insights\nManagement) allows an authenticated attacker to enumerate HTTP endpoints in the\ninternal network by specially crafting HTTP requests. On successful\nexploitation this can result in information disclosure. It has no impact on\nintegrity and availability of the application.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00262,"percentile":0.18109,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2024-08-13T03:55:04Z","modified":"2026-06-17T07:48:09Z","products":[{"vendor":"sap","product":"crm_abap_insights_management"},{"vendor":"sap_se","product":"sap crm abap (insights management)"}],"references":[{"url":"https://me.sap.com/notes/3487537","tags":["Permissions Required"]},{"url":"https://url.sap/sapsecuritypatchday","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41737"},{"url":"https://github.com/advisories/GHSA-xxmg-wvh2-q23q"}],"sources":{"cve":[{"id":"CVE-2024-41737","title":"Server-Side Request Forgery (SSRF) in SAP CRM ABAP (Insights Management)","description":"SAP CRM ABAP (Insights\nManagement) allows an authenticated attacker to enumerate HTTP endpoints in the\ninternal network by specially crafting HTTP requests. On successful\nexploitation this can result in information disclosure. It has no impact on\nintegrity and availability of the application.","status":"published","published":"2024-08-13T03:55:04.128Z","modified":"2024-08-14T16:43:20.026Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:34:03.661584Z"}],"euvd":[{"id":"EUVD-2024-39180","description":"SAP CRM ABAP (Insights\nManagement) allows an authenticated attacker to enumerate HTTP endpoints in the\ninternal network by specially crafting HTTP requests. On successful\nexploitation this can result in information disclosure. It has no impact on\nintegrity and availability of the application.","status":"published","published":"2024-08-13T03:55:04Z","modified":"2024-08-14T16:43:20Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:56:18.14573Z"}],"ghsa":[{"id":"GHSA-xxmg-wvh2-q23q","title":"SAP CRM ABAP (Insights\nManagement) allows an authenticated attacker to enumerate HTTP endpoints...","description":"SAP CRM ABAP (Insights\nManagement) allows an authenticated attacker to enumerate HTTP endpoints in the\ninternal network by specially crafting HTTP requests. On successful\nexploitation this can result in information disclosure. It has no impact on\nintegrity and availability of the application.","status":"published","published":"2024-08-13T06:30:47Z","modified":"2024-08-13T06:31:44Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:57:56.424434Z"}],"nvd":[{"id":"CVE-2024-41737","description":"SAP CRM ABAP (Insights\nManagement) allows an authenticated attacker to enumerate HTTP endpoints in the\ninternal network by specially crafting HTTP requests. On successful\nexploitation this can result in information disclosure. It has no impact on\nintegrity and availability of the application.","status":"published","published":"2024-08-13T04:15:10.003Z","modified":"2026-06-17T07:48:09.723Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:10:18.563492Z"}]}}