CVE-2024-45280 - Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver AS Java (Logon Application) · CoreCVE

Back Back to CVE browser

MEDIUM

Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver AS Java (Logon Application)

Published Sep 10, 2024

4.8

MEDIUM

CVSS 3.1

EPSS 0.24%

Description

Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confidentiality and integrity of the application. There is no impact on availability.

Affected products

Vendor SAP SE Product SAP NetWeaver AS Java (Logon Application) Default
unaffected
Affected
- 7.50

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
SAP SE	SAP NetWeaver AS Java (Logon Application)	unaffected	Affected 7.50

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-41412		Advisory
https://me.sap.com/notes/3505503
https://url.sap/sapsecuritypatchday

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner sap

Published Sep 10, 2024

Updated Sep 16, 2024

Reserved Aug 26, 2024

Link CVE-2024-45280

CISA Vulnrichment

Updated Sep 10, 2024

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2024-45280

Red Hat

No data

ENISA EUVD

Assigner sap

Published Sep 10, 2024

Updated Sep 16, 2024

Link EUVD-2024-41412

GitHub

No data