TI-2024-29687 Aliases CVE-2024-44114 GHSA-4xpj-prjw-rc6p

Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform

LOW 13CWE-863Published 2024-09-10 · Updated 2024-09-10

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.

Summary

SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that reveals data over the network. This results in a minimal impact on confidentiality of the application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00256 17th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP NetWeaver Application Server for ABAP and ABAP Platform	702; 731; 740; 750; 751; 752; 753; 754; 755; 756; 757; 758; 912	—	No fix listed	CNA

SAP NetWeaver Application Server for ABAP and ABAP Platform VendorSAP Affected 702; 731; 740; 750; 751; 752; 753; 754; 755; 756; 757; 758; 912 Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:netweaver_application_server_abap:702:::::::*	702	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:731:::::::*	731	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:740:::::::*	740	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:750:::::::*	750	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:751:::::::*	751	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:752:::::::*	752	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:753:::::::*	753	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:754:::::::*	754	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:755:::::::*	755	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:756:::::::*	756	Vulnerable	SAP

cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:*:*:*:* Versions 702 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:* Versions 731 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:* Versions 740 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:* Versions 751 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:*:*:*:* Versions 752 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:*:*:*:* Versions 753 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:*:*:*:* Versions 754 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:*:*:*:* Versions 755 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:756:*:*:*:*:*:*:* Versions 756 Vulnerable ·SAP

Show 3 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:netweaver_application_server_abap:757:::::::*	757	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:758:::::::*	758	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:912:::::::*	912	Vulnerable	SAP

cpe:2.3:a:sap:netweaver_application_server_abap:757:*:*:*:*:*:*:* Versions 757 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:758:*:*:*:*:*:*:* Versions 758 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:912:*:*:*:*:*:*:* Versions 912 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-44114
2026-10-03 Alias added: GHSA-4xpj-prjw-rc6p

References

Patch 1

https://url.sap/sapsecuritypatchday

Other 1

https://me.sap.com/notes/3507252

TI-2022-06811 SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP… KEVCVSS 3.1CRITICAL 10.0
TI-2023-21149 Missing Authorization check in SAP CommonCryptoLib CVSS 3.1CRITICAL 9.8
TI-2023-12229 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform CVSS 3.1CRITICAL 9.6
TI-2023-12228 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform CVSS 3.1CRITICAL 9.6
TI-2021-19921 Code injection in SAP ABAP Server & ABAP Platform CVSS 3.1CRITICAL 9.8
TI-2021-09062 Improper authentication in SAP NetWeaver AS ABAP and ABAP Platform CVSS 3.1CRITICAL 9.8

See all 85 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences