{"schemaVersion":3,"id":"CVE-2024-34689","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"WebFlow Services of SAP Business Workflow allows\nan authenticated attacker to enumerate accessible HTTP endpoints in the\ninternal network by specially crafting HTTP requests. On successful\nexploitation this can result in information disclosure. It has no impact on\nintegrity and availability of the application.","dates":{"published":"2024-07-09T04:18:21.258Z","modified":"2024-08-02T02:59:22.630Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00353,"percentile":0.27664,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.00353},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00353,"percentile":0.27664}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00353,"percentile":0.27664}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-918","name":"Server-Side Request Forgery (SSRF)","description":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/918.html"}],"affected":[{"vendor":"sap_se","product":"sap business workflow (webflow services)","name":"SAP Business Workflow (WebFlow Services)","label":"sap business workflow (webflow services)","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"SAP_BASIS 700","noFixRecorded":false,"fixedIn":null},{"text":"SAP_BASIS 701","noFixRecorded":false,"fixedIn":null},{"text":"SAP_BASIS 702","noFixRecorded":false,"fixedIn":null},{"text":"SAP_BASIS 731","noFixRecorded":false,"fixedIn":null},{"text":"SAP_BASIS 740","noFixRecorded":false,"fixedIn":null},{"text":"SAP_BASIS 750","noFixRecorded":false,"fixedIn":null},{"text":"SAP_BASIS 751","noFixRecorded":false,"fixedIn":null},{"text":"SAP_BASIS 752","noFixRecorded":false,"fixedIn":null},{"text":"SAP_BASIS 753","noFixRecorded":false,"fixedIn":null},{"text":"SAP_BASIS 754","noFixRecorded":false,"fixedIn":null},{"text":"SAP_BASIS 755","noFixRecorded":false,"fixedIn":null},{"text":"SAP_BASIS 756","noFixRecorded":false,"fixedIn":null},{"text":"SAP_BASIS 757","noFixRecorded":false,"fixedIn":null},{"text":"SAP_BASIS 758","noFixRecorded":false,"fixedIn":null}],"versionsText":"SAP_BASIS 700 | SAP_BASIS 701 | SAP_BASIS 702 | SAP_BASIS 731 | SAP_BASIS 740 | SAP_BASIS 750 | SAP_BASIS 751 | SAP_BASIS 752 | SAP_BASIS 753 | SAP_BASIS 754 | SAP_BASIS 755 | SAP_BASIS 756 | SAP_BASIS 757 | SAP_BASIS 758","eol":null,"hubHref":"/vendor/sap_se/sap_business_workflow_webflow_services"},{"vendor":"sap","product":"sap_basis","name":"sap basis","label":"sap_basis","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"700","noFixRecorded":false,"fixedIn":null},{"text":"701","noFixRecorded":false,"fixedIn":null},{"text":"702","noFixRecorded":false,"fixedIn":null},{"text":"731","noFixRecorded":false,"fixedIn":null},{"text":"740","noFixRecorded":false,"fixedIn":null},{"text":"750","noFixRecorded":false,"fixedIn":null},{"text":"751","noFixRecorded":false,"fixedIn":null},{"text":"752","noFixRecorded":false,"fixedIn":null},{"text":"753","noFixRecorded":false,"fixedIn":null},{"text":"754","noFixRecorded":false,"fixedIn":null},{"text":"755","noFixRecorded":false,"fixedIn":null},{"text":"756","noFixRecorded":false,"fixedIn":null},{"text":"757","noFixRecorded":false,"fixedIn":null},{"text":"758","noFixRecorded":false,"fixedIn":null}],"versionsText":"700 | 701 | 702 | 731 | 740 | 750 | 751 | 752 | 753 | 754 | 755 | 756 | 757 | 758","eol":null,"hubHref":"/vendor/sap/sap_basis"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://url.sap/sapsecuritypatchday","label":"url.sap/sapsecuritypatchday","hostname":"url.sap","tags":["Vendor Advisory"]},{"url":"https://me.sap.com/notes/3458789","label":"me.sap.com/notes/3458789","hostname":"me.sap.com","tags":["Permissions Required"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2024-07-09T04:18:21.258Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-02T02:59:22.630Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":20,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T07:14:51.429Z","stale":false,"partial":false}}