PT-2024-3872 · Sap · Sap Companion

Published 2024-02-12 · Updated 2024-10-16 · CVE-2024-22129

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions: SAP Companion versions prior to 3.1.38

Description: The issue is related to a URL with a parameter that could be vulnerable to an XSS attack. An attacker could send a malicious link to a user, potentially allowing the attacker to retrieve sensitive information and cause minor impact on the integrity of the web application. The vulnerability exists due to inadequate protection of the web page structure, which could enable a remote attacker to conduct a cross-site scripting (XSS) attack.

Recommendations: For versions prior to 3.1.38, update to version 3.1.38 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable URL parameter to minimize the risk of exploitation. Avoid using the vulnerable URL parameter in user-accessible areas until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-04274

CVE-2024-22129

Affected Products

Sap Companion

References · 9

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-22129 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04274 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-22129 · Security Note
• https://me.sap.com/notes/3404025 · Note
• https://twitter.com/CVEnew/status/1757251331759222916 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1757293668329746689 · Twitter Post
• https://vuldb.com/?id.253510 · Note
• https://twitter.com/Esparta6108713/status/1757269903781048335 · Twitter Post