CVEvulnerability

CVE-2024-34687

9.0 CRITICAL Published 2024-05-14 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-05-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS 3.1 ([email protected])
9.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-79

Description

SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker can control code that is executed within a user’s browser, which could result in modification, deletion of data, including accessing or deleting files, or stealing session cookies which an attacker could use to hijack a user’s session. Hence, this could have impact on Confidentiality, Integrity and Availability of the system.

Affected configurations

• sap sap basis 700 • sap sap basis 701 • sap sap basis 702 • sap sap basis 731 • sap sap basis 740 • sap sap basis 750 • sap sap basis 751 • sap sap basis 752 • sap sap basis 753 • sap sap basis 754 • sap sap basis 755 • sap sap basis 756 • sap sap basis 757 • sap sap basis 758 • sap sap basis 795 • sap sap basis 796

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References