{"id":"CVE-2024-41730","title":"Missing Authentication check in SAP BusinessObjects Business Intelligence Platform","summary":"In SAP BusinessObjects Business Intelligence\nPlatform, if Single Signed On is enabled on Enterprise authentication, an\nunauthorized user can get a logon token using a REST endpoint. The attacker can\nfully compromise the system resulting …","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-862"],"vendor":"SAP_SE","product":"SAP BusinessObjects Business Intelligence Platform","affected":["sap_businessobjects_business_intelligence_platform ENTERPRISE 430","sap_businessobjects_business_intelligence_platform 440"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2024-08-16T04:01:45.611523Z"},"published":"2024-08-13","updated":"2026-11-04","sourceUpdated":"2026-11-04T00:02:50.887Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-41730","references":[{"url":"https://me.sap.com/notes/3479478"},{"url":"https://url.sap/sapsecuritypatchday"}],"tags":["cve.org"],"epss":0.75866,"epssPercentile":0.99528,"ingestedAt":"2026-11-05T20:33:06.642Z","slug":"CVE-2024-41730","body":"## Overview\n\nIn SAP BusinessObjects Business Intelligence\nPlatform, if Single Signed On is enabled on Enterprise authentication, an\nunauthorized user can get a logon token using a REST endpoint. The attacker can\nfully compromise the system resulting in High impact on confidentiality,\nintegrity and availability.\n\n## Affected\n\n- `sap_businessobjects_business_intelligence_platform ENTERPRISE 430`\n- `sap_businessobjects_business_intelligence_platform 440`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":69,"depthScoreParts":{"impact":53.9,"likelihood":15.2,"exploitation":0,"ransomware":0},"changes":[]}