What’s Vulnerable › Vulnerabilities

CVE-2024-41730: Missing Authentication check in SAP BusinessObjects Business Intelligence Platform

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 75.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-13 · updated 2026-06-17
• Weakness: CWE-862

Description

In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token using a REST endpoint. The attacker can fully compromise the system resulting in High impact on confidentiality, integrity and availability.

Affected products

• SAP SE SAP BusinessObjects Business Intelligence Platform (Visual Difference Application): enterprise_430, enterprise_440

References

• https://me.sap.com/notes/3479478
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2024-41730 or the next vulnerability affects your stack