PT-2024-22122 · Sap · Sap Netweaver As Abap

Published 2024-03-11 · Updated 2024-03-12 · CVE-2024-27902

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS ABAP versions 7.89, 7.93

Description The issue is related to Cross-Site Scripting (XSS) due to insufficient encoding of user-controlled inputs in applications based on SAP GUI for HTML. This allows a malicious attacker to execute code in a user's browser, potentially accessing and modifying data. There is no impact on the system's availability.

Recommendations For versions 7.89 and 7.93, update to a version that sufficiently encodes user-controlled inputs to prevent Cross-Site Scripting (XSS) attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-27902

Affected Products

Sap Netweaver As Abap

References · 6

• https://osv.dev/vulnerability/CVE-2024-27902 · Vendor Advisory
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27902 · Security Note
• https://twitter.com/VulmonFeeds/status/1767424401589350848 · Twitter Post
• https://t.me/cvenotify/73521 · Telegram Post
• https://me.sap.com/notes/3377979 · Note