CVE-2024-37180: [CVE-2024-37180] Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

Published Jul 9, 2024

Updated

Under certain conditions SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to access remote-enabled function module with no further authorization which would otherwise be restricted, the function can be used to read non-sensitive information with low impact on confidentiality of the application.

Affected Software

16 affected components

SAP NetWeaver Application Server for ABAP

SAP ABAP Platform

SAP SAP BASIS=700

SAP SAP BASIS=701

SAP SAP BASIS=702

SAP SAP BASIS=731

SAP SAP BASIS=740

SAP SAP BASIS=750

SAP SAP BASIS=751

SAP SAP BASIS=752

SAP SAP BASIS=753

SAP SAP BASIS=754

SAP SAP BASIS=755

SAP SAP BASIS=756

SAP SAP BASIS=757

SAP SAP BASIS=758

Remediation

Patch Available

https://url.sap/sapsecuritypatchday

Event History

Jul 9, 2024

CVE Published

via MITRE·04:41 AM

Data Sourced

via MITRE·04:41 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-37180?

CVE-2024-37180 is classified as a low-severity vulnerability affecting SAP NetWeaver Application Server for ABAP and ABAP Platform.

How do I fix CVE-2024-37180?

To remediate CVE-2024-37180, apply the relevant SAP security patches as recommended by SAP.

What types of systems are affected by CVE-2024-37180?

CVE-2024-37180 affects SAP NetWeaver Application Server for ABAP and SAP ABAP Platform.

What impact does CVE-2024-37180 have?

CVE-2024-37180 allows unauthorized access to remote-enabled function modules, which can be exploited to read non-sensitive information.

Is CVE-2024-37180 being actively exploited?

As of now, there are no public reports indicating active exploitation of CVE-2024-37180.