PT-2024-4084 · Sap · Sap Crm Webclient Ui

Published 2024-02-12 · Updated 2025-10-07 · CVE-2024-22130

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP CRM WebClient UI versions S4FND 102 through S4FND 108 SAP CRM WebClient UI versions WEBCUIF 700 through WEBCUIF 801

Description The print preview option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting issue. An attacker with low privileges can cause limited impact to confidentiality and integrity of the application data after successful exploitation.

Recommendations For SAP CRM WebClient UI versions S4FND 102 through S4FND 108, update to a version that includes the fix for this issue. For SAP CRM WebClient UI versions WEBCUIF 700 through WEBCUIF 801, update to a version that includes the fix for this issue. As a temporary workaround, consider disabling the print preview option in the SAP CRM WebClient UI until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-04533

CVE-2024-22130

Affected Products

Sap Crm Webclient Ui

References · 12

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04533 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-22130 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22130 · Vendor Advisory
• https://twitter.com/dailycve/status/1975623610728697980 · Twitter Post
• https://me.sap.com/notes/3410875 · Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 · Note
• https://twitter.com/VulmonFeeds/status/1757296199621624254 · Twitter Post
• https://twitter.com/CVEnew/status/1757232452047609999 · Twitter Post
• https://t.me/cvenotify/71182 · Telegram Post
• https://twitter.com/cracbot/status/1757645891396309214 · Twitter Post
• https://t.me/cvenotify/98381 · Telegram Post