PT-2024-25052 · Sap · Sapui5

Published 2024-05-14 · Updated 2024-07-03 · CVE-2024-33007

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAPUI5 (affected versions not specified)

Description The issue concerns the execution of embedded JavaScript in PDF documents by the PDFViewer control in SAPUI5. If a PDF contains harmful client-side scripts, including JavaScript, the PDFViewer will execute these scripts, potentially leading to security threats.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-33007

Affected Products

Sapui5

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-33007 · Security Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html · Note
• https://me.sap.com/notes/3446076 · Note