CVE-2024-41735

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-41735
SAP Commerce Backoffice does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability causing low impact on confidentiality and integrity of the application.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://me.sap.com/notes/3483256 Permissions Required
https://url.sap/sapsecuritypatchday Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:commerce_backoffice:hy_com_2205:*:*:*:*:*:*:*
History

12 Sep 2024, 13:53

Type Values Removed Values Added
Summary
  • (es) SAP Commerce Backoffice no codifica suficientemente las entradas controladas por el usuario, lo que genera una vulnerabilidad de Cross-Site Scripting (XSS) que causa un bajo impacto en la confidencialidad y la integridad de la aplicación.
References () https://me.sap.com/notes/3483256 - () https://me.sap.com/notes/3483256 - Permissions Required
References () https://url.sap/sapsecuritypatchday - () https://url.sap/sapsecuritypatchday - Vendor Advisory
CPE cpe:2.3:a:sap:commerce_backoffice:hy_com_2205:*:*:*:*:*:*:*
First Time Sap commerce Backoffice
Sap

13 Aug 2024, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-13 04:15

Updated : 2024-09-12 13:53

NVD link : CVE-2024-41735

Mitre link : CVE-2024-41735

CVE.ORG link : CVE-2024-41735

JSON object : View

Products Affected

sap

  • commerce_backoffice
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')