CVE-2024-44116: 
SAP NetWeaver Application Server ABAP vulnerability analysis and mitigation

The vulnerability (CVE-2024-44116) affects SAP's RFC enabled function module, which was discovered and disclosed on September 9, 2024. The vulnerability allows a low privileged user to add any workbook to any user's workplace favourites in SAP systems. This affects multiple versions of SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, and 912 (NVD, CERT-FR).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The vulnerability is classified under CWE-862 (Missing Authorization). The technical nature of the vulnerability relates to authorization issues in the RFC enabled function module (NVD).

The vulnerability could be exploited to identify usernames and access information about targeted user's workplaces. There is a low impact on the integrity of the application. The vulnerability allows unauthorized access to workplace favourites functionality (NVD).

SAP has released security patches to address this vulnerability. Users are advised to apply the latest security updates as detailed in SAP Security Note 3488039 (SAP Security).