CVE-2024-41729CWE-359CWE-862

Information Disclosure vulnerability in the SAP NetWeaver BW (BEx Analyzer)

Medium · published September 10, 2024

CVSS v3.1
4.3
EPSS
0%
Percentile
17.0
In the wild
Unconfirmed
What it is

Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limited impact on confidentiality of the application.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00262 · 17.0th percentile
Weaknesses
CWE-359 · Exposure of Private Personal Information to an Unauthorized Actor; CWE-862 · Missing Authorization
Published
2024-09-10T02:33Z
EPSS history
Timeline
  • 10 SEP 02:33Z
    Information Disclosure vulnerability in the SAP NetWeaver BW (BEx Analyzer)
    cvelistv5