Medium severity · published Sep 10, 2024
CVE-2024-42380
Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along with all the specific data of each node. Usernames can be enumerated by exploiting vulnerability. There is low impact on confidentiality of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver Application Server for ABAP and ABAP Platform · SAP_SE
700; 701; 702; 731; 740; 750; +9 more · source: vendor
Affected product
SN
SAP NetWeaver Application Server for ABAP and ABAP Platform
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-42380
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-42380
me.sap.com
https://me.sap.com/notes/3488039
url.sap
https://url.sap/sapsecuritypatchday
More from SAP NetWeaver Application Server for ABAP and ABAP Platform
9.9
CVE-2025-0070
Improper Authentication in SAP NetWeaver ABAP Server and ABAP Platform
9.0
CVE-2024-34687
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application server for ABAP and ABAP Platform
8.8
CVE-2022-29611
SAP NetWeaver Application Server for ABAP and ABAP Platform do not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges
7.7
CVE-2026-66767
Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform
6.5
CVE-2026-40135
OS Command Injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform