What’s Vulnerable › Vulnerabilities

CVE-2024-45283: Information disclosure vulnerability in SAP NetWeaver AS for Java (Destination Service)

• Severity: medium (CVSS 6.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-10 · updated 2026-06-17
• Weakness: CWE-256

Description

SAP NetWeaver AS for Java allows an authorized attacker to obtain sensitive information. The attacker could obtain the username and password when creating an RFC destination. After successful exploitation, an attacker can read the sensitive information but cannot modify or delete the data.

Affected products

• SAP_SE SAP NetWeaver AS for Java (Destination Service): 7.50

References

• https://me.sap.com/notes/3477359
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2024-45283 or the next vulnerability affects your stack