sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2024-41732 Improper Access Control in SAP Netweaver Application Server ABAP

Medium 4.7 Published Updated

Unauthenticated attackers can bypass allowlist controls to inject CSS or links, potentially reading or modifying data in SAP NetWeaver ABAP web applications.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
A user has to click or open something
Fix
None listed

What is CVE-2024-41732?

CVE-2024-41732 is a medium-severity missing authorization vulnerability in Sap Netweaver Application Server Abap, published on 13 Aug 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web applications provided by this server, the attacker might inject CSS code or links into the web application that could allow the attacker to read or modify information. There is no impact on availability of application.

Weakness: CWE-284

Which versions are affected by CVE-2024-41732?

It affects 1 product.

Products include Sap Netweaver Application Server Abap.

How do I fix CVE-2024-41732?

No fix has been published for CVE-2024-41732 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-41732 being exploited?

There is no known exploitation of CVE-2024-41732 in the wild and no public exploit code.

All Sap Netweaver Application Server Abap vulnerabilities

Sources

Also known as GHSA-5hhx-v396-wch6.

Is CVE-2024-41732 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free