6.1

CVE-2024-39594

SAP Business Warehouse - Business Planning and
Simulation application does not sufficiently encode user controlled inputs,
resulting in Reflected Cross-Site Scripting (XSS) vulnerability. After
successful exploitation, an attacker can cause low impact on the confidentiality
and integrity of the application.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
VendorSAP_SE
≫
Product SAP Business Warehouse - Business Planning and Simulation
Default Statusunaffected
Version SAP_BW 700
Status affected
Version SAP_BW 701
Status affected
Version SAP_BW 702
Status affected
Version SAP_BW 730
Status affected
Version SAP_BW 731
Status affected
Version SAP_BW 740
Status affected
Version SAP_BW 750
Status affected
Version SAP_BW 751
Status affected
Version SAP_BW 752
Status affected
Version SAP_BW 753
Status affected
Version SAP_BW 754
Status affected
Version SAP_BW 755
Status affected
Version SAP_BW 756
Status affected
Version SAP_BW 757
Status affected
Version SAP_BW 758
Status affected
Version SAP_BW_VIRTUAL_COMP 701
Status affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.1% 0.289
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
cna@sap.com 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.