« Volver al listado

CVE-2024-34687

Estado: AnalizadaCrítica (9)—

SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker can control code that is executed within a user’s browser, which could result in modification, deletion of data, including accessing or deleting files, or stealing session cookies which an attacker could use to hijack a user’s session. Hence, this could have impact on Confidentiality, Integrity and Availability of the system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — SAP Basis

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-34687",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-34687",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-16T17:36:06.561590Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.7,
        "exploitabilityScore": 2.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP NetWeaver Application server for ABAP and ABAP Platform",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_BASIS 700"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 701"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 702"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 731"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 740"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 750"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 751"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 752"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 753"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 754"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 755"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 756"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 757"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 758"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 795"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 796"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap_and_abap_platform:sap_basis_700:*:*:*:*:*:*:*"
          ],
          "vendor": "sap_se",
          "product": "sap_netweaver_application_server_for_abap_and_abap_platform",
          "versions": [
            {
              "status": "affected",
              "version": "700",
              "versionType": "custom",
              "lessThanOrEqual": "796"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-14T16:17:26.143",
  "references": [
    {
      "url": "https://me.sap.com/notes/3448445",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
      "tags": [
        "Patch"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://me.sap.com/notes/3448445",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.\nAn attacker can control code that is executed within a user’s browser, which could result in modification, deletion of data, including accessing or deleting files, or stealing session cookies which an attacker could use to hijack a user’s session. Hence, this could have impact on Confidentiality, Integrity and Availability of the system.\n"
    },
    {
      "lang": "es",
      "value": "SAP NetWeaver Application Server para ABAP y la plataforma ABAP no codifican suficientemente las entradas controladas por el usuario, lo que genera una vulnerabilidad de Cross Site Scripting (XSS). Un atacante puede controlar el código que se ejecuta dentro del navegador de un usuario, lo que podría dar como resultado la modificación, la eliminación de datos, incluido el acceso o la eliminación de archivos, o el robo de cookies de sesión que un atacante podría usar para secuestrar la sesión de un usuario. Por lo tanto, esto podría tener un impacto en la confidencialidad, la integridad y la disponibilidad del sistema."
    }
  ],
  "lastModified": "2026-06-17T07:33:52.720",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:700:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85616273-040E-49CB-8EB6-D2D4D7B603E5"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:701:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5F2C3A9-DCC0-4FF1-8E68-9EA150E209F6"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:702:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F774A45-2A9F-4873-A5DC-766D030C8CCD"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:731:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3A0A2D6-9259-4A35-A236-F4BEE986C1FD"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:740:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "49C3A8E5-FA6A-4EF3-BF50-FD4E1576024F"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:750:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABA8AB4E-3FE6-46A8-847E-660C5DF6CE71"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:751:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6DA4A6F0-C0F1-42CB-8BBD-7198064733EA"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:752:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C121CC9-26F6-4103-8EB0-BAFF6B5B5FE8"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:753:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "86086D00-10BF-4C55-8D87-82CCBE468153"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:754:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F25246A-D9E5-4F0D-B91A-478D4E5570DB"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:755:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0218695F-C4AD-46BF-B176-F10C644A9C2D"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:756:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC9E7C3E-1005-450A-9198-E014C1BAADBC"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:757:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A177AB1-CC85-46EF-91DF-462096608C9F"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:758:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F7591F81-708C-4285-9BB2-F2B4BDB9759B"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:795:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DD27E9BD-7102-4B8B-A75A-8A94678F8633"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:796:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C70D7AC0-0389-4F7A-8ECC-B1BADB02418D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}