CVE-2024-24740 Overview
CVE-2024-24740 is an information disclosure vulnerability affecting SAP NetWeaver Application Server ABAP across multiple KERNEL releases. Under specific conditions, an unauthenticated remote attacker can retrieve information that should be restricted, resulting in a limited impact on the confidentiality of the application. The weakness is categorized under [CWE-732] (Incorrect Permission Assignment for Critical Resource). SAP addressed the issue in SAP Note #3360827.
Critical Impact
Network-accessible attackers can access restricted application information without authentication or user interaction, though the disclosed data has limited confidentiality impact.
Affected Products
- SAP NetWeaver Application Server ABAP KERNEL 7.53, 7.54, 7.77, 7.85
- SAP NetWeaver Application Server ABAP KERNEL 7.89, 7.93, 7.94
- SAP NetWeaver Application Server ABAP KRNL64UC 7.53
Discovery Timeline
- 2024-02-13 - CVE-2024-24740 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-24740
Vulnerability Analysis
The vulnerability resides in the ABAP kernel components of SAP NetWeaver Application Server. Under certain conditions, the affected kernel versions fail to enforce the expected access restrictions on specific application data. An attacker interacting with the server over the network can retrieve information that should be limited to authorized principals.
The issue is scoped to confidentiality. Integrity and availability of the application are not affected, and the disclosed information is bounded rather than arbitrary. Successful exploitation still requires reaching the exposed kernel functionality over the network without any prior authentication or user interaction.
Root Cause
The underlying defect is an incorrect permission assignment on a critical resource, tracked as [CWE-732]. The affected ABAP kernel path grants read access to data that should be subject to stricter authorization checks. Because the check is missing or overly permissive, an external caller can obtain values the system was intended to protect.
Attack Vector
Exploitation occurs over the network against the SAP NetWeaver Application Server ABAP. No credentials or user interaction are required. An attacker crafts requests that trigger the vulnerable code path in the affected kernel and receives back restricted information in the server response. No public proof-of-concept, exploit code, or CISA KEV entry is associated with this CVE at the time of writing.
Detailed exploitation mechanics are not published by SAP. Refer to SAP Note #3360827 for vendor-provided technical detail available to licensed customers.
Detection Methods for CVE-2024-24740
Indicators of Compromise
- No public indicators of compromise have been published for CVE-2024-24740.
- Anomalous unauthenticated requests to SAP NetWeaver ABAP kernel endpoints may warrant review.
- Repeated access patterns from a single source targeting ABAP application paths without prior authentication events.
Detection Strategies
- Compare running SAP kernel patch levels against the fixed versions listed in SAP Note #3360827 to identify vulnerable hosts.
- Inspect SAP Web Dispatcher, ICM, and reverse proxy logs for unauthenticated HTTP requests reaching ABAP application paths.
- Correlate outbound response sizes from ABAP endpoints against baselines to identify unexpected data exposure.
Monitoring Recommendations
- Enable SAP Security Audit Log (SM19/RSAU_CONFIG) with unsuccessful authentication and RFC call events.
- Forward SAP application, ICM, and Web Dispatcher logs to a centralized SIEM for correlation with network telemetry.
- Alert on unauthenticated access patterns to ABAP services previously accessed only by authenticated sessions.
How to Mitigate CVE-2024-24740
Immediate Actions Required
- Apply the SAP kernel patch referenced in SAP Note #3360827 to all affected KERNEL 7.53–7.94 and KRNL64UC 7.53 systems.
- Inventory all SAP NetWeaver ABAP instances and confirm patch level using SM51 or transaction SPAM.
- Restrict network exposure of SAP NetWeaver ABAP to trusted management and application segments only.
Patch Information
SAP released a corrected kernel via SAP Note #3360827. Customers should download and apply the appropriate kernel patch for their release track. See the SAP Support Portal note and the SAP February 2022 security document for advisory context and download references.
Workarounds
- SAP does not document a functional workaround; patching the kernel is the supported remediation.
- Reduce exposure by placing SAP NetWeaver ABAP behind a hardened SAP Web Dispatcher with strict URL filtering.
- Enforce network-level access controls that limit reachability of ABAP services to authenticated corporate ranges.
# Verify current SAP kernel release and patch level on the application server
disp+work -version
# Alternative: query the kernel release from the OS user (adm)
sapcontrol -nr <SYS_NR> -function GetVersionInfo
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.