CVE-2024-41730 CRITICAL

CVE-2024-41730: Missing Authentication check in SAP BusinessObjects Business Intelligence Platform

Vendor Sap_Se
Product SAP BusinessObjects Business Intelligence Platform
Weakness CWE-862 · Missing authorization
Published August 13, 2024
Last update August 16, 2024
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token using a REST endpoint. The attacker can fully compromise the system resulting in High impact on confidentiality, integrity and availability.

Key dates

02Disclosure timeline

August 13, 2024 CVE published
August 16, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-14854 WP-CRM System – Manage Clients and Projects <= 3.4.5 - Missing Authorization to Authenticated (Subscriber+) CRM Data Exposure and Task Modification CVE-2025-53255 WordPress HurryTimer plugin <= 2.13.1 - Broken Access Control Vulnerability CVE-2022-36404 WordPress Simple SEO plugin <= 1.8.12 - Broken Access Control vulnerability CVE-2025-66133 WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.7 - Broken Access Control vulnerability CVE-2023-41046 Velocity execution without script rights in Xwiki platform