Riskcovery

CVE-2024-42378

Cross-Site Scripting (XSS) in eProcurement on S/4HANA

State
Published
Severity
6.1 Medium
Published
Sep 10, 2024
Updated
Sep 10, 2024
Reserved
Jul 31, 2024

Read the record on cve.org

Description

Due to weak encoding of user-controlled inputs, eProcurement on SAP S/4HANA allows malicious scripts to be executed in the application, potentially leading to a Reflected Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the application, but it can have some minor impact on its confidentiality and integrity.

Scores

CVSSScoreVectorSource
3.16.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsap

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

ProductVersions
SAP S/4HANA eProcurementSAP_SE
  • SAP_APPL 606Affected
  • SAP_APPL 617Affected
  • SAP_APPL 618Affected
  • S4CORE 102Affected
  • S4CORE 103Affected
  • S4CORE 104Affected
  • S4CORE 105Affected
  • S4CORE 106Affected
  • S4CORE 107Affected
  • S4CORE 108Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.