cnvd - cnvd-2024-10201

cnvd-2024-10201

Vulnerability from cnvd

Title: SAP NetWeaver ABAP Server跨站脚本漏洞（CNVD-2024-10201）

Description:

SAP NetWeaver ABAP Server是德国思爱普（SAP）公司的一个用作SAP产品的Web应用程序服务器。

SAP NetWeaver ABAP Server存在跨站脚本漏洞，该漏洞源于未对用户控制的输入进行充分编码，从而导致跨站脚本(XSS)漏洞。低权限的攻击者可利用该漏洞对应用程序数据的机密性造成的影响有限。

Severity: 中

Patch Name: SAP NetWeaver ABAP Server跨站脚本漏洞（CNVD-2024-10201）的补丁

Patch Description:

SAP NetWeaver ABAP Server是德国思爱普（SAP）公司的一个用作SAP产品的Web应用程序服务器。

SAP NetWeaver ABAP Server存在跨站脚本漏洞，该漏洞源于未对用户控制的输入进行充分编码，从而导致跨站脚本(XSS)漏洞。低权限的攻击者可利用该漏洞对应用程序数据的机密性造成的影响有限。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已提供漏洞修复方案，请关注厂商主页更新： https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364

Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-21738

Impacted products

Name
['SAP Netweaver Application Server ABAP 756', 'SAP Netweaver Application Server ABAP 753', 'SAP Netweaver Application Server ABAP 754', 'SAP Netweaver Application Server ABAP 755', 'SAP Netweaver Application Server ABAP 750', 'SAP Netweaver Application Server ABAP 752', 'SAP Netweaver Application Server ABAP 740', 'SAP Netweaver Application Server ABAP 751', 'SAP Netweaver Application Server ABAP 757', 'SAP Netweaver Application Server ABAP 702', 'SAP Netweaver Application Server ABAP 700', 'SAP Netweaver Application Server ABAP 731', 'SAP Netweaver Application Server ABAP 701', 'SAP Netweaver Application Server ABAP 758', 'SAP Netweaver Application Server ABAP 793', 'SAP Netweaver Application Server ABAP 79']

Name

['SAP Netweaver Application Server ABAP 756', 'SAP Netweaver Application Server ABAP 753', 'SAP Netweaver Application Server ABAP 754', 'SAP Netweaver Application Server ABAP 755', 'SAP Netweaver Application Server ABAP 750', 'SAP Netweaver Application Server ABAP 752', 'SAP Netweaver Application Server ABAP 740', 'SAP Netweaver Application Server ABAP 751', 'SAP Netweaver Application Server ABAP 757', 'SAP Netweaver Application Server ABAP 702', 'SAP Netweaver Application Server ABAP 700', 'SAP Netweaver Application Server ABAP 731', 'SAP Netweaver Application Server ABAP 701', 'SAP Netweaver Application Server ABAP 758', 'SAP Netweaver Application Server ABAP 793', 'SAP Netweaver Application Server ABAP 79']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-21738",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21738"
    }
  },
  "description": "SAP NetWeaver ABAP Server\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u7528\u4f5cSAP\u4ea7\u54c1\u7684Web\u5e94\u7528\u7a0b\u5e8f\u670d\u52a1\u5668\u3002\n\nSAP NetWeaver ABAP Server\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u672a\u5bf9\u7528\u6237\u63a7\u5236\u7684\u8f93\u5165\u8fdb\u884c\u5145\u5206\u7f16\u7801\uff0c\u4ece\u800c\u5bfc\u81f4\u8de8\u7ad9\u811a\u672c(XSS)\u6f0f\u6d1e\u3002\u4f4e\u6743\u9650\u7684\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bf9\u5e94\u7528\u7a0b\u5e8f\u6570\u636e\u7684\u673a\u5bc6\u6027\u9020\u6210\u7684\u5f71\u54cd\u6709\u9650\u3002",
  "formalWay": "\u5382\u5546\u5df2\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-10201",
  "openTime": "2024-02-22",
  "patchDescription": "SAP NetWeaver ABAP Server\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u7528\u4f5cSAP\u4ea7\u54c1\u7684Web\u5e94\u7528\u7a0b\u5e8f\u670d\u52a1\u5668\u3002\r\n\r\nSAP NetWeaver ABAP Server\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u672a\u5bf9\u7528\u6237\u63a7\u5236\u7684\u8f93\u5165\u8fdb\u884c\u5145\u5206\u7f16\u7801\uff0c\u4ece\u800c\u5bfc\u81f4\u8de8\u7ad9\u811a\u672c(XSS)\u6f0f\u6d1e\u3002\u4f4e\u6743\u9650\u7684\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bf9\u5e94\u7528\u7a0b\u5e8f\u6570\u636e\u7684\u673a\u5bc6\u6027\u9020\u6210\u7684\u5f71\u54cd\u6709\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "SAP NetWeaver ABAP Server\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2024-10201\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "SAP Netweaver Application Server ABAP 756",
      "SAP Netweaver Application Server ABAP 753",
      "SAP Netweaver Application Server ABAP 754",
      "SAP Netweaver Application Server ABAP 755",
      "SAP Netweaver Application Server ABAP 750",
      "SAP Netweaver Application Server ABAP 752",
      "SAP Netweaver Application Server ABAP 740",
      "SAP Netweaver Application Server ABAP 751",
      "SAP Netweaver Application Server ABAP 757",
      "SAP Netweaver Application Server ABAP 702",
      "SAP Netweaver Application Server ABAP 700",
      "SAP Netweaver Application Server ABAP 731",
      "SAP Netweaver Application Server ABAP 701",
      "SAP Netweaver Application Server ABAP 758",
      "SAP Netweaver Application Server ABAP 793",
      "SAP Netweaver Application Server ABAP 79"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2024-21738",
  "serverity": "\u4e2d",
  "submitTime": "2024-01-12",
  "title": "SAP NetWeaver ABAP Server\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2024-10201\uff09"
}

CVE-2024-21738 (GCVE-0-2024-21738)

Vulnerability from cvelistv5

Published

2024-01-09 01:19

Modified

2025-06-03 14:33

Severity ?

4.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Summary

SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker with low privileges can cause limited impact to confidentiality of the application data after successful exploitation.

References

▼	URL	Tags
	https://me.sap.com/notes/3387737
	https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Impacted products

	Vendor	Product	Version
	SAP_SE	SAP NetWeaver ABAP Application Server and ABAP Platform	Version: SAP_BASIS 700 Version: SAP_BASIS 701 Version: SAP_BASIS 702 Version: SAP_BASIS 731 Version: SAP_BASIS 740 Version: SAP_BASIS 750 Version: SAP_BASIS 751 Version: SAP_BASIS 752 Version: SAP_BASIS 753 Version: SAP_BASIS 754 Version: SAP_BASIS 755 Version: SAP_BASIS 756 Version: SAP_BASIS 757 Version: SAP_BASIS 758 Version: SAP_BASIS 793 Version: SAP_BASIS 794

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:27:35.894Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://me.sap.com/notes/3387737"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21738",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T15:56:36.439121Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-03T14:33:28.278Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP NetWeaver ABAP Application Server and ABAP Platform",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_BASIS 700"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 701"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 702"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 731"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 740"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 750"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 751"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 752"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 753"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 754"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 755"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 756"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 757"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 758"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 793"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 794"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.\u00a0An attacker with low privileges can cause limited impact to confidentiality of the application data after successful exploitation.\u003c/p\u003e"
            }
          ],
          "value": "SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.\u00a0An attacker with low privileges can cause limited impact to confidentiality of the application data after successful exploitation.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "eng",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-09T01:19:29.437Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3387737"
        },
        {
          "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Application Server and ABAP Platform",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2024-21738",
    "datePublished": "2024-01-09T01:19:29.437Z",
    "dateReserved": "2024-01-01T10:54:59.645Z",
    "dateUpdated": "2025-06-03T14:33:28.278Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted