CVE-2024-27902

MEDIUM

SAP NetWeaver AS ABAP 7.89, 7.93 - Cross-Site Scripting

Title source: llm
STIX 2.1

Description

Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. A successful attack can allow a malicious attacker to access and modify data through their ability to execute code in a user’s browser. There is no impact on the availability of the system

References (2)

Core 2

Scores

CVSS v3 5.4
EPSS 0.0078
EPSS Percentile 73.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
sap/netweaver_as_abap sap_ui_7.89
sap/netweaver_as_abap sap_ui_7.93
Published Mar 12, 2024
Tracked Since Feb 18, 2026