6.1

CVE-2024-39594

[CVE-2024-39594] Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Warehouse - Business Planning and Simulation

SAP Business Warehouse - Business Planning and
Simulation application does not sufficiently encode user controlled inputs,
resulting in Reflected Cross-Site Scripting (XSS) vulnerability. After
successful exploitation, an attacker can cause low impact on the confidentiality
and integrity of the application.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
SAP ≫ Business Warehouse Version 700
SAP ≫ Business Warehouse Version 701
SAP ≫ Business Warehouse Version 702
SAP ≫ Business Warehouse Version 730
SAP ≫ Business Warehouse Version 731
SAP ≫ Business Warehouse Version 740
SAP ≫ Business Warehouse Version 750
SAP ≫ Business Warehouse Version 751
SAP ≫ Business Warehouse Version 752
SAP ≫ Business Warehouse Version 753
SAP ≫ Business Warehouse Version 754
SAP ≫ Business Warehouse Version 755
SAP ≫ Business Warehouse Version 756
SAP ≫ Business Warehouse Version 757
SAP ≫ Business Warehouse Version 758
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.26% 0.167
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
SAP 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://url.sap/sapsecuritypatchday
Patch
https://me.sap.com/notes/3482217
Permissions Required