Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2024-42378

Cross-Site Scripting (XSS) in eProcurement on S/4HANA

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

Due to weak encoding of user-controlled inputs, eProcurement on SAP S/4HANA allows malicious scripts to be executed in the application, potentially leading to a Reflected Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the application, but it can have some minor impact on its confidentiality and integrity.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP_SE SAP S/4HANA eProcurement

Default version status: unaffected

  • SAP_APPL 606affected
  • SAP_APPL 617affected
  • SAP_APPL 618affected
  • S4CORE 102affected
  • S4CORE 103affected
  • S4CORE 104affected
  • S4CORE 105affected
  • S4CORE 106affected
  • S4CORE 107affected
  • S4CORE 108affected

References