CVE-2024-37173
published 2024-07-09CVE-2024-37173: Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a…
PriorityP430medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.27%
18.1th percentile
Due to insufficient input validation, SAP
CRM WebClient UI allows an unauthenticated attacker to craft a URL link which
embeds a malicious script. When a victim clicks on this link, the script will
be executed in the victim's browser giving the attacker the ability to access
and/or modify information with no effect on availability of the application.
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap | customer_relationship_management_s4fnd | — | — |
| sap | customer_relationship_management_s4fnd | — | — |
| sap | customer_relationship_management_s4fnd | — | — |
| sap | customer_relationship_management_s4fnd | — | — |
| sap | customer_relationship_management_s4fnd | — | — |
| sap | customer_relationship_management_s4fnd | — | — |
| sap | customer_relationship_management_s4fnd | — | — |
| sap | customer_relationship_management_webclient_ui | — | — |
| sap | customer_relationship_management_webclient_ui | — | — |
| sap | customer_relationship_management_webclient_ui | — | — |
| sap | customer_relationship_management_webclient_ui | — | — |
| sap | customer_relationship_management_webclient_ui | — | — |
| sap | customer_relationship_management_webclient_ui | — | — |
| sap | customer_relationship_management_webclient_ui | — | — |
| sap_se | sap_crm_webclient_ui | — | — |
| sap_se | sap_crm_webclient_ui | — | — |
| sap_se | sap_crm_webclient_ui | — | — |
| sap_se | sap_crm_webclient_ui | — | — |
| sap_se | sap_crm_webclient_ui | — | — |
| sap_se | sap_crm_webclient_ui | — | — |
| sap_se | sap_crm_webclient_ui | — | — |
| sap_se | sap_crm_webclient_ui | — | — |
| sap_se | sap_crm_webclient_ui | — | — |
| sap_se | sap_crm_webclient_ui | — | — |
| sap_se | sap_crm_webclient_ui | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-07-09
Published