CVE-2024-42380: 
SAP NetWeaver Application Server ABAP vulnerability analysis and mitigation

CVE-2024-42380 is a security vulnerability in SAP systems that affects the RFC enabled function module. The vulnerability was disclosed on September 9, 2024. The vulnerability allows a low privileged user to read any user's workplace favourites and user menu along with all the specific data of each node (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified as CWE-862 (Missing Authorization). The technical assessment indicates that the vulnerability primarily impacts the confidentiality of the application (NVD).

The primary impact of this vulnerability is on the confidentiality of the application, as it allows unauthorized access to user workplace favourites and menu data. Additionally, the vulnerability can be exploited to enumerate usernames, potentially exposing user information (NVD).

SAP has released security patches to address this vulnerability. Organizations are advised to review and implement the security updates provided in the SAP Security Patch Day documentation (SAP Patch Day, SAP Note).