Medium severity · published Feb 13, 2024
CVE-2024-24740
Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (SAP Kernel)
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
SAP NetWeaver Application Server (ABAP) - versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94, KRNL64UC 7.53, under certain conditions, allows an attacker to access information which could otherwise be restricted with low impact on confidentiality of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver Application Server ABAP (SAP Kernel) · SAP_SE
KERNEL 7.53; KERNEL 7.54; KERNEL 7.77; KERNEL 7.85; KERNEL 7.89; KERNEL 7.93; +2 more · source: vendor
NA
Netweaver Application Server Abap · Sap
kernel_7.53; kernel_7.54; kernel_7.77; kernel_7.85; kernel_7.89; kernel_7.93; +2 more · source: NVD
Affected product
SN
SAP NetWeaver Application Server ABAP (SAP Kernel)
SAP_SE