Medium severity · published Jul 9, 2024
CVE-2024-34689
[CVE-2024-34689] Server-Side Request Forgery in SAP Business Workflow (WebFlow Services)
5.0
CVSS
0.4%
EPSS
No
On KEV
Description
WebFlow Services of SAP Business Workflow allows
an authenticated attacker to enumerate accessible HTTP endpoints in the
internal network by specially crafting HTTP requests. On successful
exploitation this can result in information disclosure. It has no impact on
integrity and availability of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
SAP Business Workflow (WebFlow Services) · SAP_SE
SAP_BASIS 700; SAP_BASIS 701; SAP_BASIS 702; SAP_BASIS 731; SAP_BASIS 740; SAP_BASIS 750; +8 more · source: vendor
BW
Business Workflow · Sap
All versions, or not specified · source: NVD
SB
Sap Basis · Sap
700; 701; 702; 731; 740; 750; +8 more · source: NVD
SB
Sap Business Workflow \(webflow Services\) · Sap SE
SAP_BASIS 700; SAP_BASIS 701; SAP_BASIS 702; SAP_BASIS 731; SAP_BASIS 740; SAP_BASIS 750; +8 more · source: CISA
Affected product
SB
SAP Business Workflow (WebFlow Services)
SAP_SE