CVE-2024-34684

mediumpriority · track · 24EPSS 0.001 · 4 %ileDEEUNLUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.14% (4th) EPSS

CVSS 6 · medium

Is it mine?

10 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · ncsc_nl

EPSS · scored 2026-10-27

On Unix, SAP BusinessObjects Business Intelligence Platform (Scheduling) allows an authenticated attacker with administrator access on the local server to access the password of a local account. As a result, an attacker can obtain non-administrative user credentials, which will allow them to read or modify the remote server files.

cvss

Technical severity, 0–10. One row per scoring source.

6.0

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.7–6

v3.16mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Nprimary · NVD / NIST USexploitability 0.8 · impact 5.2

v3.13.7lowCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:Nsecondary · ENISA EU

v3.13.7lowCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:Nsecondary · cna@sap.comexploitability 0.6 · impact 2.7

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.13.7lowCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:Nsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-200USCWE-200US

affected products (10)

Products and version ranges known to be affected.

SAP Softwareall versionscert_bundDEcpe:/a:sap:sap:-
SAP_SE SAP BusinessObjects Business Intelligence Platform≤ ENTERPRISE 420enisa_euvdEU
SAP_SE SAP BusinessObjects Business Intelligence Platform≤ 440enisa_euvdEU
SAP_SE SAP BusinessObjects Business Intelligence Platform≤ 430enisa_euvdEU
sap_businessobjects_business_intelligence_platformall versionsncsc_nlNLcpe:2.3:a:sap_se:sap_businessobjects_business_intelligence_platform:430:*:*:*:*:*:*:*
sap_businessobjects_business_intelligence_platformall versionsncsc_nlNLcpe:2.3:a:sap_se:sap_businessobjects_business_intelligence_platform:440:*:*:*:*:*:*:*
sap_businessobjects_business_intelligence_platformall versionsncsc_nlNLcpe:2.3:a:sap_se:sap_businessobjects_business_intelligence_platform:enterprise_420:*:*:*:*:*:*:*
sap businessobjects business intelligence platform= 420nvdUScpe:2.3:a:sap:businessobjects_business_intelligence_platform:*:*:*:*:*:*:*:*
sap businessobjects business intelligence platform= 430nvdUScpe:2.3:a:sap:businessobjects_business_intelligence_platform:*:*:*:*:*:*:*:*
sap businessobjects business intelligence platform= 440nvdUScpe:2.3:a:sap:businessobjects_business_intelligence_platform:*:*:*:*:*:*:*:*

advisories (2)

Vendor and ecosystem advisories describing this.

NCSC-2024-0247Kwetsbaarheden verholpen in SAP productenNL2024-06-11csaf · ncsc_nlNL
SAP heeft kwetsbaarheden verholpen in diverse SAP producten, zoals Business Objects, HANA, CRM en NetWeaver.
WID-SEC-W-2024-1327SAP Software: Mehrere SchwachstellenDeutsch2024-06-10csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um seine Privilegien zu erhöhen, Cross-Site-Scripting (XSS)-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand erzeugen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund ncsc_nl nvd NVD CVE.org MITRE

published 2024-06-11modified 2026-06-17

references (9)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan