PT-2024-4069 · Sap · Sap Nwbc For Html

Published

2024-02-12

·

Updated

2026-02-25

·

CVE-2024-22128

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions: SAP NWBC for HTML - versions SAP UI 754 through SAP UI 758 SAP NWBC for HTML - versions SAP BASIS 700 through SAP BASIS 702 SAP NWBC for HTML - version SAP BASIS 731
Description: The issue arises from insufficient encoding of user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious javascript, causing limited impact to the confidentiality and integrity of the application data after successful exploitation. The vulnerability can be exploited by a remote attacker to conduct an XSS attack, potentially affecting the structure of web pages.
Recommendations: For SAP UI versions 754 through 758, update to a version that sufficiently encodes user-controlled inputs to prevent XSS attacks. For SAP BASIS versions 700 through 702, update to a version that sufficiently encodes user-controlled inputs to prevent XSS attacks. For SAP BASIS version 731, update to a version that sufficiently encodes user-controlled inputs to prevent XSS attacks.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-04516
CVE-2024-22128

Affected Products

Sap Nwbc For Html