Riskcovery

CVE-2024-39594

[CVE-2024-39594] Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Warehouse - Business Planning and Simulation

State
Published
Severity
6.1 Medium
Published
Jul 9, 2024
Updated
Aug 2, 2024
Reserved
Jun 26, 2024

Read the record on cve.org

Description

SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause low impact on the confidentiality and integrity of the application.

Scores

CVSSScoreVectorSource
3.16.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsap

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation

Affected Products

ProductVersions
SAP Business Warehouse - Business Planning and SimulationSAP_SE
  • SAP_BW 700Affected
  • SAP_BW 701Affected
  • SAP_BW 702Affected
  • SAP_BW 730Affected
  • SAP_BW 731Affected
  • SAP_BW 740Affected
  • SAP_BW 750Affected
  • SAP_BW 751Affected
  • SAP_BW 752Affected
  • SAP_BW 753Affected
  • SAP_BW 754Affected
  • SAP_BW 755Affected
  • SAP_BW 756Affected
  • SAP_BW 757Affected
  • SAP_BW 758Affected
  • SAP_BW_VIRTUAL_COMP 701Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.