CVE-2024-45278

SAP Commerce Backoffice does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.
References
Link Resource
https://me.sap.com/notes/3507545 Permissions Required
https://url.sap/sapsecuritypatchday Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:commerce_backoffice:2205:*:*:*:*:*:*:*
cpe:2.3:a:sap:commerce_backoffice:2211:*:*:*:*:*:*:*

History

14 Nov 2024, 17:17

Type Values Removed Values Added
First Time Sap
Sap commerce Backoffice
References () https://me.sap.com/notes/3507545 - () https://me.sap.com/notes/3507545 - Permissions Required
References () https://url.sap/sapsecuritypatchday - () https://url.sap/sapsecuritypatchday - Vendor Advisory
CPE cpe:2.3:a:sap:commerce_backoffice:2205:*:*:*:*:*:*:*
cpe:2.3:a:sap:commerce_backoffice:2211:*:*:*:*:*:*:*

10 Oct 2024, 12:57

Type Values Removed Values Added
Summary
  • (es) SAP Commerce Backoffice no codifica lo suficiente las entradas controladas por el usuario, lo que genera una vulnerabilidad de tipo Cross-Site Scripting (XSS). Después de una explotación exitosa, un atacante puede causar un impacto limitado en la confidencialidad e integridad de la aplicación.

08 Oct 2024, 04:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-10-08 04:15

Updated : 2024-11-14 17:17


NVD link : CVE-2024-45278

Mitre link : CVE-2024-45278

CVE.ORG link : CVE-2024-45278


JSON object : View

Products Affected

sap

  • commerce_backoffice
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')