« Volver al listado

CVE-2024-39595

Estado: AnalizadaMedia (5.4)—

SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user-controlled inputs, resulting in Stored Cross-Site Scripting (XSS) vulnerability. This vulnerability allows users to modify website content and on successful exploitation, an attacker can cause low impact to the confidentiality and integrity of the application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

SAP — Business WarehouseSAP — Business Warehouse Virtual Comp

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-39595",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-39595",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-09T14:53:52.958466Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP Business Warehouse - Business Planning and Simulation",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_BW 700"
            },
            {
              "status": "affected",
              "version": "SAP_BW 701"
            },
            {
              "status": "affected",
              "version": "SAP_BW 702"
            },
            {
              "status": "affected",
              "version": "SAP_BW 730"
            },
            {
              "status": "affected",
              "version": "SAP_BW 731"
            },
            {
              "status": "affected",
              "version": "SAP_BW 740"
            },
            {
              "status": "affected",
              "version": "SAP_BW 750"
            },
            {
              "status": "affected",
              "version": "SAP_BW 751"
            },
            {
              "status": "affected",
              "version": "SAP_BW 752"
            },
            {
              "status": "affected",
              "version": "SAP_BW 753"
            },
            {
              "status": "affected",
              "version": "SAP_BW 754"
            },
            {
              "status": "affected",
              "version": "SAP_BW 755"
            },
            {
              "status": "affected",
              "version": "SAP_BW 756"
            },
            {
              "status": "affected",
              "version": "SAP_BW 757"
            },
            {
              "status": "affected",
              "version": "SAP_BW 758"
            },
            {
              "status": "affected",
              "version": "SAP_BW_VIRTUAL_COMP 701"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-07-09T05:15:12.507",
  "references": [
    {
      "url": "https://me.sap.com/notes/3482217",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "tags": [
        "Patch"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://me.sap.com/notes/3482217",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Business Warehouse - Business Planning and\nSimulation application does not sufficiently encode user-controlled inputs,\nresulting in Stored Cross-Site Scripting (XSS) vulnerability. This\nvulnerability allows users to modify website content and on successful\nexploitation, an attacker can cause low impact to the confidentiality and\nintegrity of the application."
    },
    {
      "lang": "es",
      "value": "SAP Business Warehouse: la aplicación de simulación y planificación empresarial no codifica suficientemente las entradas controladas por el usuario, lo que genera una vulnerabilidad de Cross Site Scripting almacenado (XSS). Esta vulnerabilidad permite a los usuarios modificar el contenido del sitio web y, si se explota con éxito, un atacante puede causar poco impacto en la confidencialidad y la integridad de la aplicación."
    }
  ],
  "lastModified": "2026-06-17T07:42:17.930",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:700:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D495F997-45A9-4C80-841E-781E1EAC3074"
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:701:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2FCA6F5A-25B8-46E1-B407-38F61222C057"
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:702:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3FE999EE-9B6B-4D2C-9347-5558B878AE7B"
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:730:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF8F2CE3-BA4B-4A9C-A284-87F0AB797B92"
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:731:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00732AD2-BEED-4C1F-AC39-46E6F33CBB5E"
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:740:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC7DABAD-36FA-49D7-8C3C-3AA49604BE37"
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:750:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "526C11C6-B67D-49F1-94E6-A324AA581EDD"
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:751:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A4E38AC-5888-4ABD-AAB1-BC5312701195"
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:752:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D7A93A1-3D65-4C79-92B1-E433EE443478"
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:753:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "80E03381-893C-4646-9150-303AB4F6144B"
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:754:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1400B8E5-8400-420A-8581-9F3B07EF6BF4"
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:755:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2ABE173B-C66E-4A69-9735-E325C0DAC062"
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:756:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CEF64C99-2AEF-4942-90AC-053CE56293F3"
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:757:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8E527DF-7066-4869-A914-DD29979EE90D"
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse:758:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "093021E9-112A-4828-AE86-8B32BCC9B8B1"
            },
            {
              "criteria": "cpe:2.3:a:sap:business_warehouse_virtual_comp:701:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F10F39E6-41C6-46E7-855A-8D05055A8142"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}