CVE-2024-42380

{"id": "CVE-2024-42380", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-09-10T03:15:02.653", "references": [{"url": "https://me.sap.com/notes/3488039", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along with all the specific data of each node. Usernames can be enumerated by exploiting vulnerability. There is low impact on confidentiality of the application."}, {"lang": "es", "value": "El m\u00f3dulo de funci\u00f3n habilitado para RFC permite que un usuario con pocos privilegios lea los favoritos del lugar de trabajo y el men\u00fa de usuario de cualquier usuario junto con todos los datos espec\u00edficos de cada nodo. Los nombres de usuario se pueden enumerar aprovechando la vulnerabilidad. El impacto en la confidencialidad de la aplicaci\u00f3n es bajo."}], "lastModified": "2024-09-10T12:09:50.377", "sourceIdentifier": "cna@sap.com"}