PT-2024-5562 · Sap · Sap Businessobjects Business Intelligence Platform

Published 2024-08-12 · Updated 2025-09-22 · CVE-2024-41730

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SAP BusinessObjects Business Intelligence Platform versions 4.30 and 4.40

The issue involves a missing authentication check in the SAP BusinessObjects Business Intelligence Platform when Single Signed On is enabled on Enterprise authentication. An unauthorized user can obtain a logon token by accessing a REST endpoint. Successful exploitation allows an attacker to fully compromise the system, impacting confidentiality, integrity, and availability.

Recommendations: Apply the security note 3479478. Update to the latest security patch package released in August 2024. Update to the latest security patch package released in October 2024.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2024-06241

CVE-2024-41730

Affected Products

Sap Businessobjects Business Intelligence Platform

References · 50

• https://nvd.nist.gov/vuln/detail/CVE-2024-41730 · Security Note
• https://url.sap/sapsecuritypatchday · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06241 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41730 · Vendor Advisory
• https://twitter.com/patchnow24x7/status/1823577071433687284 · Twitter Post
• https://twitter.com/vuldb/status/1823245365682008329 · Twitter Post
• https://twitter.com/PorsilapongoCl/status/1823206639417147582 · Twitter Post
• https://twitter.com/Dhananj82759483/status/1823576286649835948 · Twitter Post
• https://twitter.com/CVEnew/status/1823205696512606408 · Twitter Post
• https://t.me/CSIRT_italia/2750 · Telegram Post
• https://t.me/pentestingnews/50338 · Telegram Post
• https://twitter.com/Dhananj82759483/status/1823576219889160560 · Twitter Post
• https://t.me/true_secator/6097 · Telegram Post
• https://twitter.com/ncsc_gov_ie/status/1844399833794453628 · Twitter Post
• https://twitter.com/Dhananj82759483/status/1823576164222357524 · Twitter Post