CVE-2024-25645

Under certain condition SAP NetWeaver (Enterprise Portal) - version 7.50 allows an attacker to access information which would otherwise be restricted causing low impact on confidentiality of the application and with no impact on Integrity and Availability of the application.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3428847	Permissions Required
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364	Vendor Advisory
https://me.sap.com/notes/3428847	Permissions Required
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:netweaver_enterprise_portal:7.50:*:*:*:*:*:*:*

History

07 Feb 2025, 17:24

Type	Values Removed	Values Added
CPE		cpe:2.3:a:sap:netweaver_enterprise_portal:7.50:::::::*
First Time		Sap netweaver Enterprise Portal Sap
References	~~() https://me.sap.com/notes/3428847 -~~	() https://me.sap.com/notes/3428847 - Permissions Required
References	~~() https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 -~~	() https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 - Vendor Advisory

Information

Published : 2024-03-12 01:15

Updated : 2025-02-07 17:24

NVD link : CVE-2024-25645

Mitre link : CVE-2024-25645

CVE.ORG link : CVE-2024-25645

JSON object : View

Products Affected

sap

netweaver_enterprise_portal

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2024-25645", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-03-12T01:15:49.780", "references": [{"url": "https://me.sap.com/notes/3428847", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://me.sap.com/notes/3428847", "tags": ["Permissions Required"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Under certain condition\u00a0SAP\u00a0NetWeaver (Enterprise Portal) - version 7.50\u00a0allows an attacker to access information which would otherwise be restricted causing low impact on confidentiality of the application and with no impact on Integrity and Availability of the application."}, {"lang": "es", "value": "Bajo ciertas condiciones, SAP NetWeaver (Enterprise Portal): la versi\u00f3n 7.50 permite a un atacante acceder a informaci\u00f3n que de otro modo estar\u00eda restringida, lo que causa un impacto bajo en la confidencialidad de la aplicaci\u00f3n y sin impacto en la integridad y disponibilidad de la aplicaci\u00f3n."}], "lastModified": "2025-02-07T17:24:54.693", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:netweaver_enterprise_portal:7.50:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D91F9D76-39D6-4D5E-BFAE-892CB8C30A79"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}