TI-2024-16873 Aliases CVE-2024-25645 GHSA-5h2w-j5gq-rvfq

Information Disclosure vulnerability in SAP NetWeaver (Enterprise Portal)

LOW 24CWE-732Published 2024-03-12 · Updated 2024-09-28

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Under certain condition SAP NetWeaver (Enterprise Portal) - version 7.50 allows an attacker to access information which would otherwise be restricted causing low impact on confidentiality of the application and with no impact on Integrity and Availability of the application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0041 35th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP NetWeaver (Enterprise Portal)	7.50	—	No fix listed	CNA

SAP NetWeaver (Enterprise Portal) VendorSAP Affected 7.50 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:netweaver_enterprise_portal:7.50:::::::*	7.50	Vulnerable	SAP

cpe:2.3:a:sap:netweaver_enterprise_portal:7.50:*:*:*:*:*:*:* Versions 7.50 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-25645
2026-10-03 Alias added: GHSA-5h2w-j5gq-rvfq

References

Advisory 1

https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364

Other 1

https://me.sap.com/notes/3428847

TI-2023-13271 Missing Authentication check in SAP NetWeaver Enterprise Portal CVSS 3.1MEDIUM 6.5
TI-2023-11608 XML External Entity (XXE) vulnerability in SAP NetWeaver (SAP Enterprise Portal) CVSS 3.1MEDIUM 6.8
TI-2021-13077 Cross-site scripting in SAP NetWeaver Enterprise Portal CVSS 3.1MEDIUM 6.1
TI-2021-13076 Cross-site scripting in SAP NetWeaver Enterprise Portal CVSS 3.1MEDIUM 6.1
TI-2018-01817 Cross-site scripting in SAP NetWeaver Enterprise Portal CVSS 3.0MEDIUM 6.1
TI-2022-13954 Cross-site scripting in SAP NetWeaver Enterprise Portal CVSS 3.1MEDIUM 6.1

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences