9

CVE-2024-34687

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application server for ABAP and ABAP Platform

SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
An attacker can control code that is executed within a user’s browser, which could result in modification, deletion of data, including accessing or deleting files, or stealing session cookies which an attacker could use to hijack a user’s session. Hence, this could have impact on Confidentiality, Integrity and Availability of the system.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
SAP ≫ Sap Basis Version 700
SAP ≫ Sap Basis Version 701
SAP ≫ Sap Basis Version 702
SAP ≫ Sap Basis Version 731
SAP ≫ Sap Basis Version 740
SAP ≫ Sap Basis Version 750
SAP ≫ Sap Basis Version 751
SAP ≫ Sap Basis Version 752
SAP ≫ Sap Basis Version 753
SAP ≫ Sap Basis Version 754
SAP ≫ Sap Basis Version 755
SAP ≫ Sap Basis Version 756
SAP ≫ Sap Basis Version 757
SAP ≫ Sap Basis Version 758
SAP ≫ Sap Basis Version 795
SAP ≫ Sap Basis Version 796
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.4% 0.318
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9 2.3 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
SAP 6.5 2.3 3.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
Patch
https://me.sap.com/notes/3448445
Permissions Required