CVE-2024-24742 MEDIUM

CVE-2024-24742: Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)

Vendor Sap_Se
Product SAP CRM (WebClient UI)
Weakness CWE-79 · XSS
Published February 13, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

4.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

What the vulnerability does

01Description

SAP CRM WebClient UI - version S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker with low privileges can cause limited impact to integrity of the application data after successful exploitation. There is no impact on confidentiality and availability.

Key dates

02Disclosure timeline

February 13, 2024 CVE published
August 1, 2024 Record updated