Medium severity · published Jul 9, 2024
CVE-2024-39595
[CVE-2024-39594] Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Warehouse - Business Planning and Simulation
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
SAP Business Warehouse - Business Planning and
Simulation application does not sufficiently encode user-controlled inputs,
resulting in Stored Cross-Site Scripting (XSS) vulnerability. This
vulnerability allows users to modify website content and on successful
exploitation, an attacker can cause low impact to the confidentiality and
integrity of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
SAP Business Warehouse - Business Planning and Simulation · SAP_SE
SAP_BW 700; SAP_BW 701; SAP_BW 702; SAP_BW 730; SAP_BW 731; SAP_BW 740; +10 more · source: vendor
BW
Business Warehouse · Sap
700; 701; 702; 730; 731; 740; +9 more · source: NVD
BW
Business Warehouse Virtual Comp · Sap
701 · source: NVD
Affected product
SB
SAP Business Warehouse - Business Planning and Simulation
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-39595
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-39595
Permissions Required
https://me.sap.com/notes/3482217
Patch
https://url.sap/sapsecuritypatchday
More from SAP Business Warehouse - Business Planning and Simulation
6.1
CVE-2024-39594
[CVE-2024-39594] Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Warehouse - Business Planning and Simulation