CVE-2024-41730: 
SAP BusinessObjects Business Intelligence Platform vulnerability analysis and mitigation

A critical vulnerability (CVE-2024-41730) was discovered in SAP BusinessObjects Business Intelligence Platform, affecting Enterprise versions 430 and 440. The vulnerability was disclosed on August 13, 2024, and involves a missing authorization check when Single Signed On is enabled on Enterprise authentication (SecurityWeek, NVD).

The vulnerability has been assigned a Critical CVSS v3.1 base score of 9.8 with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The flaw is categorized as CWE-862 (Missing Authorization) and allows unauthorized users to obtain a logon token through a REST endpoint (NVD, SecurityOnline).

The vulnerability can lead to full system compromise with high impact on confidentiality, integrity, and availability. An attacker successfully exploiting this vulnerability could gain complete control over the affected system (SecurityWeek, SecurityOnline).

SAP initially released patches for this vulnerability in August 2024 and subsequently updated the security note with additional patches for customers using BusinessObjects version 4.2 SP009. Organizations are strongly advised to apply the security patches as soon as possible (SecurityWeek).