CVE-2024-39594

Description

SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause low impact on the confidentiality and integrity of the application.

Reserved 2024-06-26 | Published 2024-07-09 | Updated 2024-08-02 | Assigner sap

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation

Product status

Default status
unaffected

SAP_BW 700
affected

SAP_BW 701
affected

SAP_BW 702
affected

SAP_BW 730
affected

SAP_BW 731
affected

SAP_BW 740
affected

SAP_BW 750
affected

SAP_BW 751
affected

SAP_BW 752
affected

SAP_BW 753
affected

SAP_BW 754
affected

SAP_BW 755
affected

SAP_BW 756
affected

SAP_BW 757
affected

SAP_BW 758
affected

SAP_BW_VIRTUAL_COMP 701
affected

References

url.sap/sapsecuritypatchday

me.sap.com/notes/3482217

cve.org (CVE-2024-39594)

nvd.nist.gov (CVE-2024-39594)

Download JSON