CVE-2024-24740: sap_se sap netweaver application server abap (sap kernel)

Vulnerability summary

CVE-2024-24740 is a medium (CVSS 5.3) vulnerability in sap_se sap netweaver application server abap (sap kernel). EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.5% of scored vulnerabilities.

Timeline

1. 13-02-2024
   PublishedVulnerability first disclosed.
2. 09-05-2025
   Last modifiedVulnerability information updated.

Description

SAP NetWeaver Application Server (ABAP) - versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94, KRNL64UC 7.53, under certain conditions, allows an attacker to access information which could otherwise be restricted with low impact on confidentiality of the application.

• CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.