CVE-2024-39598

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-39598

5.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

S

AP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application.

References
Link Resource
https://me.sap.com/notes/3467377 Permissions Required
https://url.sap/sapsecuritypatchday Vendor Advisory
https://me.sap.com/notes/3467377 Permissions Required
https://url.sap/sapsecuritypatchday Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:customer_relationship_management_s4fnd:102:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:103:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:104:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:105:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:106:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:107:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:108:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:701:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:731:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:746:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:747:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:748:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:800:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:801:*:*:*:*:*:*:*
History

21 Nov 2024, 09:28

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.7 		v2 : unknown
v3 : 5.0
References () https://me.sap.com/notes/3467377 - Permissions Required () https://me.sap.com/notes/3467377 - Permissions Required
References () https://url.sap/sapsecuritypatchday - Vendor Advisory () https://url.sap/sapsecuritypatchday - Vendor Advisory

29 Aug 2024, 19:04

Type Values Removed Values Added
References () https://me.sap.com/notes/3467377 - () https://me.sap.com/notes/3467377 - Permissions Required
References () https://url.sap/sapsecuritypatchday - () https://url.sap/sapsecuritypatchday - Vendor Advisory
CVSS v2 : unknown
v3 : 5.0 		v2 : unknown
v3 : 7.7
First Time Sap customer Relationship Management S4fnd
Sap customer Relationship Management Webclient Ui
Sap
CPE cpe:2.3:a:sap:customer_relationship_management_s4fnd:106:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:801:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:748:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:103:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:108:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:105:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:731:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:104:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:701:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:800:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:747:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:102:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:107:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:746:*:*:*:*:*:*:*

09 Jul 2024, 18:19

Type Values Removed Values Added
Summary
  • (es) SAP CRM (WebClient UI Framework) permite a un atacante autenticado enumerar endpoints HTTP accesibles en la red interna mediante la elaboración especial de solicitudes HTTP. Si se explota con éxito, esto puede dar lugar a la divulgación de información. No tiene ningún impacto en la integridad y disponibilidad de la aplicación.

09 Jul 2024, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-09 04:15

Updated : 2024-11-21 09:28

NVD link : CVE-2024-39598

Mitre link : CVE-2024-39598

CVE.ORG link : CVE-2024-39598

JSON object : View

Products Affected

sap

CWE
CWE-918

Server-Side Request Forgery (SSRF)