CVE-2024-32733

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

State: Published
Severity: 6.1 Medium
Published: May 14, 2024
Updated: Aug 2, 2024
Reserved: Apr 17, 2024

Description

Due to missing input validation and output encoding of untrusted data, SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject malicious JavaScript code into the dynamically crafted web page. On successful exploitation the attacker can access or modify sensitive information with no impact on availability of the application

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	sap

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
SAP NetWeaver Application Server ABAP and ABAP PlatformSAP_SE	SAP_BASIS 740Affected SAP_BASIS 750Affected SAP_BASIS 751Affected SAP_BASIS 752Affected SAP_BASIS 753Affected SAP_BASIS 754Affected SAP_BASIS 755Affected SAP_BASIS 756Affected SAP_BASIS 757Affected SAP_BASIS 758Affected SAP_BASIS 795Affected SAP_BASIS 796Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.