« Volver al listado

CVE-2026-24323

Estado: AnalizadaMedia (6.1)—

The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sanitized. When a victim accesses a crafted URL, the injected script is executed in the victim�s browser, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

SAP — Document Management SystemSAP — ERPSAP — S4core

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-24323",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-24323",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-10T16:19:53.737158Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP Document Management System",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_APPL 618"
            },
            {
              "status": "affected",
              "version": "S4CORE 102"
            },
            {
              "status": "affected",
              "version": "103"
            },
            {
              "status": "affected",
              "version": "104"
            },
            {
              "status": "affected",
              "version": "105"
            },
            {
              "status": "affected",
              "version": "106"
            },
            {
              "status": "affected",
              "version": "107"
            },
            {
              "status": "affected",
              "version": "108"
            },
            {
              "status": "affected",
              "version": "109"
            },
            {
              "status": "affected",
              "version": "EA-APPL 600"
            },
            {
              "status": "affected",
              "version": "602"
            },
            {
              "status": "affected",
              "version": "603"
            },
            {
              "status": "affected",
              "version": "604"
            },
            {
              "status": "affected",
              "version": "605"
            },
            {
              "status": "affected",
              "version": "606"
            },
            {
              "status": "affected",
              "version": "617"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-02-10T04:16:04.467",
  "references": [
    {
      "url": "https://me.sap.com/notes/3678417",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sanitized. When a victim accesses a crafted URL, the injected script is executed in the victim�s browser, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application."
    },
    {
      "lang": "es",
      "value": "Las aplicaciones BSP permiten a un usuario no autenticado inyectar contenido de script malicioso a través de parámetros de URL controlados por el usuario que no están suficientemente saneados. Cuando una víctima accede a una URL manipulada, el script inyectado se ejecuta en el navegador de la víctima, lo que conlleva un impacto bajo en la confidencialidad y la integridad, y ningún impacto en la disponibilidad de la aplicación."
    }
  ],
  "lastModified": "2026-06-17T10:22:54.217",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:document_management_system:600:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FD522469-1153-4A3C-9271-2338A5674BDA"
            },
            {
              "criteria": "cpe:2.3:a:sap:document_management_system:602:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D355E922-5592-41C7-ACE4-311044B9E8C3"
            },
            {
              "criteria": "cpe:2.3:a:sap:document_management_system:603:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E8A41C8-812E-4319-B515-CF9F030DAA19"
            },
            {
              "criteria": "cpe:2.3:a:sap:document_management_system:604:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B470B7D-486C-43B0-B9B0-AC0A16034A01"
            },
            {
              "criteria": "cpe:2.3:a:sap:document_management_system:605:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0024390E-91C7-48B5-8E04-265E9E6D4E75"
            },
            {
              "criteria": "cpe:2.3:a:sap:document_management_system:606:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "133C3E0D-2D67-479A-A678-07EB04244BCB"
            },
            {
              "criteria": "cpe:2.3:a:sap:document_management_system:617:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7E1D717-FA00-47D5-94B6-E818848890C6"
            },
            {
              "criteria": "cpe:2.3:a:sap:erp:618:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4573BD22-D50B-431E-928A-C495E342D1AE"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:102:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04C95A73-48EB-446C-A5F0-20E1D6BC1779"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:103:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C3C9003-68A6-4886-8979-9B7D01A35E40"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:104:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "964023CE-6EA4-42BB-93B2-DCE6B36D3F89"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:105:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84B775EF-6C11-4FAB-B5E7-8F6C4C5674BE"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:106:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "14D17245-5B6D-4024-AFA6-8E0A70B294BF"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:107:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5DEFABE8-1797-4C7B-941C-3205AE90914B"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:108:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78832FB6-B1DD-4516-B1DF-D90BB58BF25A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}