fkie_cve-2024-39595
Vulnerability from fkie_nvd
Published
2024-07-09 05:15
Modified
2025-10-28 18:41
Severity ?
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user-controlled inputs, resulting in Stored Cross-Site Scripting (XSS) vulnerability. This vulnerability allows users to modify website content and on successful exploitation, an attacker can cause low impact to the confidentiality and integrity of the application.
References
cna@sap.comhttps://me.sap.com/notes/3482217Permissions Required
cna@sap.comhttps://url.sap/sapsecuritypatchdayPatch
af854a3a-2127-422b-91ae-364da2661108https://me.sap.com/notes/3482217Permissions Required
af854a3a-2127-422b-91ae-364da2661108https://url.sap/sapsecuritypatchdayPatch
Impacted products
Vendor Product Version
sap business_warehouse 700
sap business_warehouse 701
sap business_warehouse 702
sap business_warehouse 730
sap business_warehouse 731
sap business_warehouse 740
sap business_warehouse 750
sap business_warehouse 751
sap business_warehouse 752
sap business_warehouse 753
sap business_warehouse 754
sap business_warehouse 755
sap business_warehouse 756
sap business_warehouse 757
sap business_warehouse 758
sap business_warehouse_virtual_comp 701


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:700:*:*:*:*:*:*:*",
              "matchCriteriaId": "D495F997-45A9-4C80-841E-781E1EAC3074",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:701:*:*:*:*:*:*:*",
              "matchCriteriaId": "2FCA6F5A-25B8-46E1-B407-38F61222C057",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:702:*:*:*:*:*:*:*",
              "matchCriteriaId": "3FE999EE-9B6B-4D2C-9347-5558B878AE7B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:730:*:*:*:*:*:*:*",
              "matchCriteriaId": "EF8F2CE3-BA4B-4A9C-A284-87F0AB797B92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:731:*:*:*:*:*:*:*",
              "matchCriteriaId": "00732AD2-BEED-4C1F-AC39-46E6F33CBB5E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:740:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC7DABAD-36FA-49D7-8C3C-3AA49604BE37",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:750:*:*:*:*:*:*:*",
              "matchCriteriaId": "526C11C6-B67D-49F1-94E6-A324AA581EDD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:751:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A4E38AC-5888-4ABD-AAB1-BC5312701195",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:752:*:*:*:*:*:*:*",
              "matchCriteriaId": "8D7A93A1-3D65-4C79-92B1-E433EE443478",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:753:*:*:*:*:*:*:*",
              "matchCriteriaId": "80E03381-893C-4646-9150-303AB4F6144B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:754:*:*:*:*:*:*:*",
              "matchCriteriaId": "1400B8E5-8400-420A-8581-9F3B07EF6BF4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:755:*:*:*:*:*:*:*",
              "matchCriteriaId": "2ABE173B-C66E-4A69-9735-E325C0DAC062",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:756:*:*:*:*:*:*:*",
              "matchCriteriaId": "CEF64C99-2AEF-4942-90AC-053CE56293F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:757:*:*:*:*:*:*:*",
              "matchCriteriaId": "C8E527DF-7066-4869-A914-DD29979EE90D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:758:*:*:*:*:*:*:*",
              "matchCriteriaId": "093021E9-112A-4828-AE86-8B32BCC9B8B1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse_virtual_comp:701:*:*:*:*:*:*:*",
              "matchCriteriaId": "F10F39E6-41C6-46E7-855A-8D05055A8142",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Business Warehouse - Business Planning and\nSimulation application does not sufficiently encode user-controlled inputs,\nresulting in Stored Cross-Site Scripting (XSS) vulnerability. This\nvulnerability allows users to modify website content and on successful\nexploitation, an attacker can cause low impact to the confidentiality and\nintegrity of the application."
    },
    {
      "lang": "es",
      "value": "SAP Business Warehouse: la aplicaci\u00f3n de simulaci\u00f3n y planificaci\u00f3n empresarial no codifica suficientemente las entradas controladas por el usuario, lo que genera una vulnerabilidad de Cross Site Scripting almacenado (XSS). Esta vulnerabilidad permite a los usuarios modificar el contenido del sitio web y, si se explota con \u00e9xito, un atacante puede causar poco impacto en la confidencialidad y la integridad de la aplicaci\u00f3n."
    }
  ],
  "id": "CVE-2024-39595",
  "lastModified": "2025-10-28T18:41:39.603",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "cna@sap.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-07-09T05:15:12.507",
  "references": [
    {
      "source": "cna@sap.com",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://me.sap.com/notes/3482217"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Patch"
      ],
      "url": "https://url.sap/sapsecuritypatchday"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://me.sap.com/notes/3482217"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "cna@sap.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.