CVE-2024-27902

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
6.1MEDIUM
EPSS
0.8%
top 26.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP SE SAP Netweaver AS Abap Applications Based ON Sapgui FOR Html (webgui)SAP Netweaver AS Abap
Timeline
PublishedMar 12

Description

Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. A successful attack can allow a malicious attacker to access and modify data through their ability to execute code in a user’s browser. There is no impact on the availability of the system

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶NVDsap/netweaver_as_abapsap_ui_7.89, sap_ui_7.93+1

🔴Vulnerability Details

2
GHSA
GHSA-rh37-q3m6-762g: Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7↗2024-03-12
▶
CVEList
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP applications based on SAPGUI for HTML (WebGUI)↗2024-03-12
▶
CVE-2024-27902 (MEDIUM CVSS 6.1) | Applications based on SAP GUI for H | cvebase.io