CVE-2024-24742

sap crm - webclient ui

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2024-24742

Katalog CVE

CVSS 4.1 · Medium EPSS 0,33%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada sap crm - webclient ui. Skor CVSS 3.1 4.1 (Medium) menurut NVD.

Deskripsi (NVD)

SAP CRM WebClient UI - version S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker with low privileges can cause limited impact to integrity of the application data after successful exploitation. There is no impact on confidentiality and availability.

Rincian

Terbit di NVD
13 Februari 2024
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
4.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari)
0,33% peluang dieksploitasi; lebih tinggi dari 24,2% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
sap crm - webclient ui Versi s4fnd_102
sap crm - webclient ui Versi s4fnd_103
sap crm - webclient ui Versi s4fnd_104
sap crm - webclient ui Versi s4fnd_105
sap crm - webclient ui Versi s4fnd_106
sap crm - webclient ui Versi webcuif_701
sap crm - webclient ui Versi webcuif_731
sap crm - webclient ui Versi webcuif_746
sap crm - webclient ui Versi webcuif_747
sap crm - webclient ui Versi webcuif_748
sap crm - webclient ui Versi webcuif_800
sap crm - webclient ui Versi webcuif_801

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.