Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-27902

Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. A successful attack can allow a malicious attacker to access and modify data through their ability to execute code in a user’s browser. There is no impact on the availability of the system

Published

2024-03-12T01:15:50.193

Last Modified

2025-02-26T16:32:20.917

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 5.4 (MEDIUM)

Weaknesses

Type: Primary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	sap	netweaver_as_abap	sap_ui_7.89	Yes
Application	sap	netweaver_as_abap	sap_ui_7.93	Yes

References

https://me.sap.com/notes/3377979 Permissions Required ([email protected])
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 Vendor Advisory ([email protected])
https://me.sap.com/notes/3377979 Permissions Required (af854a3a-2127-422b-91ae-364da2661108)
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)