[CVE-2024-39594] Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Warehouse - Business Planning and Simulation (SAP_SE SAP Business Warehouse - Business Planning and Simulation)
En bref
- Source
- NVD
- EPSS
- EPSS 0.24 % · centile 15 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sap
- Statut NVD
- Analyzed
Description
SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user-controlled inputs, resulting in Stored Cross-Site Scripting (XSS) vulnerability. This vulnerability allows users to modify website content and on successful exploitation, an attacker can cause low impact to the confidentiality and integrity of the application.
Faiblesses (CWE)
- CWE-79 — Injection de code indirecte (XSS)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | sap |
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | NVD · cna@sap.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2024-38115
- GCVE · GCVE-0-2024-39595
Avis du CERT-FR
- CERTFR-2024-AVI-0554 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:sap:business_warehouse:700:*:*:*:*:*:*:*cpe:2.3:a:sap:business_warehouse:701:*:*:*:*:*:*:*cpe:2.3:a:sap:business_warehouse:702:*:*:*:*:*:*:*cpe:2.3:a:sap:business_warehouse:730:*:*:*:*:*:*:*cpe:2.3:a:sap:business_warehouse:731:*:*:*:*:*:*:*cpe:2.3:a:sap:business_warehouse:740:*:*:*:*:*:*:*cpe:2.3:a:sap:business_warehouse:750:*:*:*:*:*:*:*cpe:2.3:a:sap:business_warehouse:751:*:*:*:*:*:*:*cpe:2.3:a:sap:business_warehouse:752:*:*:*:*:*:*:*cpe:2.3:a:sap:business_warehouse:753:*:*:*:*:*:*:*cpe:2.3:a:sap:business_warehouse:754:*:*:*:*:*:*:*cpe:2.3:a:sap:business_warehouse:755:*:*:*:*:*:*:*cpe:2.3:a:sap:business_warehouse:756:*:*:*:*:*:*:*cpe:2.3:a:sap:business_warehouse:757:*:*:*:*:*:*:*cpe:2.3:a:sap:business_warehouse:758:*:*:*:*:*:*:*cpe:2.3:a:sap:business_warehouse_virtual_comp:701:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| SAP_SE · SAP Business Warehouse - Business Planning and Simulation | affected SAP_BW 700 ; affected SAP_BW 701 ; affected SAP_BW 702 ; affected SAP_BW 730 ; affected SAP_BW 731 ; affected SAP_BW 740 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |