Medium severity · published Jul 9, 2024
CVE-2024-39593
SAP Landscape Management allows an authenticated user to read confidential data disclosed by the REST Provider Definition response
5.7
CVSS
0.3%
EPSS
No
On KEV
Description
SAP Landscape Management allows an authenticated
user to read confidential data disclosed by the REST Provider Definition
response. Successful exploitation can cause high impact on confidentiality of
the managed entities.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LM
Landscape Management · Sap
3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-39593
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-39593
Permissions Required
https://me.sap.com/notes/3466801
Vendor Advisory
https://url.sap/sapsecuritypatchday
More from Landscape Management
9.8
CVE-2019-0261
Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks properly for XS advanced platform and…
8.7
CVE-2023-26458
An information disclosure vulnerability exists in SAP Landscape Management - version 3.0, enterprise edition
7.5
CVE-2019-0249
Under certain conditions SAP Landscape Management (VCM 3.0) allows an attacker to access information which would otherwise be restricted
7.2
CVE-2020-6236
SAP Landscape Management, version 3.0, and SAP Adaptive Extensions, version 1.0, allows an attacker with admin_group privileges to change ownership and permissions (including…
7.2
CVE-2020-6192
SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious commands with root privileges in SAP Host Agent via SAP Landscape Management