CVE-2024-24742

MEDIUM

SAP CRM WebClient UI - S4FND 102-WEBCUIF 801 - XSS

Title source: llm
STIX 2.1

Description

SAP CRM WebClient UI - version S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker with low privileges can cause limited impact to integrity of the application data after successful exploitation. There is no impact on confidentiality and availability.

References (2)

Core 2

Scores

CVSS v3 4.1
EPSS 0.0022
EPSS Percentile 44.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (12)
sap/crm_-_webclient_ui s4fnd_102
sap/crm_-_webclient_ui s4fnd_103
sap/crm_-_webclient_ui s4fnd_104
sap/crm_-_webclient_ui s4fnd_105
sap/crm_-_webclient_ui s4fnd_106
sap/crm_-_webclient_ui webcuif_701
sap/crm_-_webclient_ui webcuif_731
sap/crm_-_webclient_ui webcuif_746
sap/crm_-_webclient_ui webcuif_747
sap/crm_-_webclient_ui webcuif_748
... and 2 more
Published Feb 13, 2024
Tracked Since Feb 18, 2026