CVE-2024-41729

Information Disclosure vulnerability in the SAP NetWeaver BW (BEx Analyzer)

State: Published
Severity: 4.3 Medium
Published: Sep 10, 2024
Updated: Sep 10, 2024
Reserved: Jul 22, 2024

Description

Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limited impact on confidentiality of the application.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	sap

Weaknesses

CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
CWE-862 Missing Authorization

Affected Products

Product	Versions
SAP NetWeaver BW (BEx Analyzer)SAP_SE	DW4CORE 200Affected DW4CORE 300Affected DW4CORE 400Affected SAP_BW 700Affected SAP_BW 701Affected SAP_BW 702Affected SAP_BW 731Affected SAP_BW 740Affected SAP_BW 750Affected SAP_BW 751Affected SAP_BW 752Affected SAP_BW 753Affected SAP_BW 754Affected SAP_BW 755Affected SAP_BW 756Affected SAP_BW 757Affected SAP_BW 758Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.