Get all your news in one place.

100’s of premium titles.
One app.

Get all your news in one place.

100’s of premium titles. One news app.

TechRadar

Sead Fadilpašić

This critical security flaw is letting SAP users get around authentication

SAP

SAP Building.

SAP has fixed more than a dozen security vulnerabilities, including two critical-severity ones which could have allowed threat actors to take full control over a flawed endpoint.

In a security advisory, SAP detailed the “missing authentication check” vulnerability affecting SAP BusinessObjects Business Intelligence PLatform versions 430, and 440. The bug is tracked as CVE-2024-41730, and carries a severity score of 9.8 (critical).

"In SAP BusinessObjects Business Intelligence Platform, if Single Sign On is enabled on Enterprise authentication, an unauthorized user can get a logon token using a REST endpoint," SAP explained in the advisory. "The attacker can fully compromise the system resulting in High impact on confidentiality, integrity and availability."

Server-side request forgeries, and more

The second critical vulnerability is a server-side request forgery (SSRF) flaw affecting apps built with SAP Build Apps prior to version 4.11.130. This bug was introduced through a fix for a previous vulnerability, and is tracked as CVE-2024-29415. It carries a severity score of 9.1. The bug was found in the ‘IP’ package for Node.js, when it analyzes if an IP address is public or not. With octal representation, the package erroneously recognizes ‘127.0.0.1’ as a public and globally routable address.

SAP is the world’s largest ERP vendor, with products in use by more than 90% of the Forbes Global 2000 list, so cybercriminals will most likely scan for endpoints that haven’t applied the patch, looking for a way into the IT networks of some of the world’s most important brands.

Besides these two, SAP fixed another four high-severity vulnerabilities, with scores ranging from 7.4 to 8.2. These include an XML injection issue in the SAP BEx Web Java Runtime Export Web Service, a bug in SAP S/4 HANA, one in SAP NetWeaver AS Java, and one in SAP Commerce Cloud.

Via Bleeping Computer

More from TechRadar Pro

SAP's AI Core platform has some worrying security flaws, so patch now
Here's a list of the best malware removal tools around today
These are the best endpoint security tools right now

Sign up to read this article

Read news from 100’s of titles, curated specifically for you.

Already a member? Sign in here

Top stories on inkl right now

Pelicot rape trial: ‘It is Gisèle’s name that will be remembered’

Pelicot rape trial: ‘It is Gisèle’s name that will be remembered’

Woman who has become a feminist hero says she is ‘determined to change society’ as trial approaches its end

The Guardian - UK

Smoke without fire: Burning LA building which prompted 911 calls turns out to be movie set

Smoke without fire: Burning LA building which prompted 911 calls turns out to be movie set

Los Angeles Fire Department confirmed in a statement that the fire was not real

The Independent UK

Nicaraguan Parliament Approves Constitutional Reform Granting More Power To President

Nicaraguan Parliament Approves Constitutional Reform Granting More Power To President

Nicaragua's constitutional reform raises concerns over democracy and human rights due to increased presidential authority.

Tennessee Man Avoids Prison In Young Dolph Murder Case

Tennessee Man Avoids Prison In Young Dolph Murder Case

Jermarcus Johnson sentenced to probation for aiding killers in aftermath of rapper Young Dolph's murder. Case reveals complexities of music industry feuds.

One subscription that gives you access to news from hundreds of sites

Already a member? Sign in here

Homeowner Killed by Cop After Calling to Report Break-In Predicted His Own Death on 911 Call: 'I Don't Think I'll Be Alive'

Homeowner Killed by Cop After Calling to Report Break-In Predicted His Own Death on 911 Call: 'I Don't Think I'll Be Alive'

A Las Vegas homeowner shot to death in his own home by cops previously told dispatchers while reporting a break-in in a 911 call, "I don't think I'll be alive."

California case is the first confirmed bird flu infection in a US child

California case is the first confirmed bird flu infection in a US child

Health officials are confirming bird flu in a California child — the first reported case in a U.S. minor

The Independent UK

Related Stories

Top stories on inkl right now

Pelicot rape trial: ‘It is Gisèle’s name that will be remembered’

Pelicot rape trial: ‘It is Gisèle’s name that will be remembered’

Woman who has become a feminist hero says she is ‘determined to change society’ as trial approaches its end

The Guardian - UK

Smoke without fire: Burning LA building which prompted 911 calls turns out to be movie set

Smoke without fire: Burning LA building which prompted 911 calls turns out to be movie set

Los Angeles Fire Department confirmed in a statement that the fire was not real

The Independent UK

Nicaraguan Parliament Approves Constitutional Reform Granting More Power To President

Nicaraguan Parliament Approves Constitutional Reform Granting More Power To President

Nicaragua's constitutional reform raises concerns over democracy and human rights due to increased presidential authority.

Tennessee Man Avoids Prison In Young Dolph Murder Case

Tennessee Man Avoids Prison In Young Dolph Murder Case

Jermarcus Johnson sentenced to probation for aiding killers in aftermath of rapper Young Dolph's murder. Case reveals complexities of music industry feuds.

One subscription that gives you access to news from hundreds of sites

Already a member? Sign in here

Homeowner Killed by Cop After Calling to Report Break-In Predicted His Own Death on 911 Call: 'I Don't Think I'll Be Alive'

Homeowner Killed by Cop After Calling to Report Break-In Predicted His Own Death on 911 Call: 'I Don't Think I'll Be Alive'

A Las Vegas homeowner shot to death in his own home by cops previously told dispatchers while reporting a break-in in a 911 call, "I don't think I'll be alive."

California case is the first confirmed bird flu infection in a US child

California case is the first confirmed bird flu infection in a US child

Health officials are confirming bird flu in a California child — the first reported case in a U.S. minor

The Independent UK

Our Picks

Best tinted serums to get your skin glowing

The ultra-lightweight base product packed with skin-loving ingredients

Evening Standard

Dua Lipa’s pickle drink is latest twist in growing appreciation for ‘dirty’ cocktails

Brine from pickled onions, beetroot, pickles and even oysters is now a fixture on bar menus across the UK

The Guardian - UK

No, mouth-taping won’t give you a ‘snatched’ jaw. But it might improve your sleep quality

IN FOCUS: As the trend of taping one’s lips closed at night goes viral, Inga Parkel speaks to experts about whether the practice actually has any aesthetic benefits – or if it’s yet another online sensation best to brush off

The Independent UK

'Squid Game' showrunner teases 'more intriguing games' for season 2 of the Netflix hit

Plus, what's in store for fans when 'Squid Game' season 3 drops in 2025

Ellen DeGeneres embraces fresh start in England with bold new look

DeGeneres was seen with a brand new hairstyle while spending time in Jeremy Clarkson’s pub in the Cotswolds

The Independent UK

“People have used it as their wedding song. I often think, ‘Hey, did you listen to the lyrics?’”: The classic number one hit with a sting in its tail

And with the money it made, the band bought an oil well!

Fourteen days free

Download the app

One app. One membership.
100+ trusted global sources.

Download on the AppStore

Get it on Google Play