// For flags

CVE-2024-39598

[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)

Severity Score

5.0
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

SAP CRM (WebClient UI Framework) allows an
authenticated attacker to enumerate accessible HTTP endpoints in the internal
network by specially crafting HTTP requests. On successful exploitation this
can result in information disclosure. It has no impact on integrity and
availability of the application.

SAP CRM (WebClient UI Framework) permite a un atacante autenticado enumerar endpoints HTTP accesibles en la red interna mediante la elaboración especial de solicitudes HTTP. Si se explota con éxito, esto puede dar lugar a la divulgación de información. No tiene ningún impacto en la integridad y disponibilidad de la aplicación.

SAP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Complete
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-06-26 CVE Reserved
  • 2024-07-09 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-08-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-918: Server-Side Request Forgery (SSRF)
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
SAP SE
Search vendor "SAP SE"
 SAP CRM WebClient UI
Search vendor "SAP SE" for product "SAP CRM WebClient UI"
 701
Search vendor "SAP SE" for product "SAP CRM WebClient UI" and version "701"
en
Affected
SAP SE
Search vendor "SAP SE"
 SAP CRM WebClient UI
Search vendor "SAP SE" for product "SAP CRM WebClient UI"
 731
Search vendor "SAP SE" for product "SAP CRM WebClient UI" and version "731"
en
Affected
SAP SE
Search vendor "SAP SE"
 SAP CRM WebClient UI
Search vendor "SAP SE" for product "SAP CRM WebClient UI"
 746
Search vendor "SAP SE" for product "SAP CRM WebClient UI" and version "746"
en
Affected
SAP SE
Search vendor "SAP SE"
 SAP CRM WebClient UI
Search vendor "SAP SE" for product "SAP CRM WebClient UI"
 747
Search vendor "SAP SE" for product "SAP CRM WebClient UI" and version "747"
en
Affected
SAP SE
Search vendor "SAP SE"
 SAP CRM WebClient UI
Search vendor "SAP SE" for product "SAP CRM WebClient UI"
 748
Search vendor "SAP SE" for product "SAP CRM WebClient UI" and version "748"
en
Affected
SAP SE
Search vendor "SAP SE"
 SAP CRM WebClient UI
Search vendor "SAP SE" for product "SAP CRM WebClient UI"
 800
Search vendor "SAP SE" for product "SAP CRM WebClient UI" and version "800"
en
Affected
SAP SE
Search vendor "SAP SE"
 SAP CRM WebClient UI
Search vendor "SAP SE" for product "SAP CRM WebClient UI"
 801
Search vendor "SAP SE" for product "SAP CRM WebClient UI" and version "801"
en
Affected