CVE-2026-24316

{"id": "CVE-2026-24316", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24316", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T15:36:06.953702Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.1}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP NetWeaver Application Server for ABAP", "versions": [{"status": "affected", "version": "SAP_BASIS 740"}, {"status": "affected", "version": "SAP_BASIS 750"}, {"status": "affected", "version": "SAP_BASIS 751"}, {"status": "affected", "version": "SAP_BASIS 752"}, {"status": "affected", "version": "SAP_BASIS 753"}, {"status": "affected", "version": "SAP_BASIS 754"}, {"status": "affected", "version": "SAP_BASIS 755"}, {"status": "affected", "version": "SAP_BASIS 756"}, {"status": "affected", "version": "SAP_BASIS 757"}, {"status": "affected", "version": "SAP_BASIS 758"}, {"status": "affected", "version": "SAP_BASIS 816"}, {"status": "affected", "version": "SAP_BASIS 918"}], "defaultStatus": "unaffected"}]}], "published": "2026-03-10T17:35:55.860", "references": [{"url": "https://me.sap.com/notes/3689080", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external endpoints. The report is therefore vulnerable to Server-Side Request Forgery (SSRF). Successful exploitation could lead to interaction with potentially sensitive internal endpoints, resulting in a low impact on data confidentiality and integrity. There is no impact on availability of the application."}, {"lang": "es", "value": "SAP NetWeaver Servidor de aplicaciones para ABAP proporciona un informe ABAP para fines de prueba, que permite enviar peticiones HTTP a puntos finales internos o externos arbitrarios. El informe es, por lo tanto, vulnerable a Falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF). La explotaci\u00f3n exitosa podr\u00eda conducir a interacci\u00f3n con puntos finales internos potencialmente sensibles, lo que resulta en un bajo impacto en la confidencialidad e integridad de los datos. No hay impacto en la disponibilidad de la aplicaci\u00f3n."}], "lastModified": "2026-06-17T10:22:53.467", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:sap_basis:*:*:*", "vulnerable": true, "matchCriteriaId": "8E96C58C-ED44-487B-A67E-FDAE3C29023A"}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:sap_basis:*:*:*", "vulnerable": true, "matchCriteriaId": "A14DF5EB-B8CE-4A47-9959-2F65A5DCEF5F"}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:sap_basis:*:*:*", "vulnerable": true, "matchCriteriaId": "419BA423-0803-4F51-8889-014A521F02CE"}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:sap_basis:*:*:*", "vulnerable": true, "matchCriteriaId": "DA20ECDC-8807-462C-A0F0-70DF6F5A119B"}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:sap_basis:*:*:*", "vulnerable": true, "matchCriteriaId": "800AAC21-325C-4F16-AE5A-9F89327E5356"}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:sap_basis:*:*:*", "vulnerable": true, "matchCriteriaId": "BDC15DB7-A95B-475F-AAA6-60A801F65690"}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:756:*:*:*:sap_basis:*:*:*", "vulnerable": true, "matchCriteriaId": "55A2FECF-A32E-4188-9563-E8BA0E952261"}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:757:*:*:*:sap_basis:*:*:*", "vulnerable": true, "matchCriteriaId": "9CBF2E53-17F0-4BF0-9C38-749C7E611BF4"}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:758:*:*:*:sap_basis:*:*:*", "vulnerable": true, "matchCriteriaId": "5160572B-E3AB-4B96-8950-07DDAFA0E4A6"}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:816:*:*:*:sap_basis:*:*:*", "vulnerable": true, "matchCriteriaId": "32888162-53F9-4598-8C04-E4A4903AAB57"}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:918:*:*:*:sap_basis:*:*:*", "vulnerable": true, "matchCriteriaId": "F5311510-6456-4B0A-B3D6-932397A2D4A6"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}