CVE-2024-34685

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-34685
Due to weak encoding of user-controlled input in SAP NetWeaver Knowledge Management XMLEditor which allows malicious scripts can be executed in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the application but it has a low impact on its confidentiality and integrity.

6.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://url.sap/sapsecuritypatchday Vendor Advisory
https://me.sap.com/notes/3468681 Permissions Required
Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:netweaver_knowledge_management_and_collaboration_\(kmc-cm\):7.50:*:*:*:*:*:*:*
History

29 Aug 2024, 19:29

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1
CPE cpe:2.3:a:sap:netweaver_knowledge_management_and_collaboration_\(kmc-cm\):7.50:*:*:*:*:*:*:*
First Time Sap
Sap netweaver Knowledge Management And Collaboration \(kmc-cm\)
References () https://me.sap.com/notes/3468681 - () https://me.sap.com/notes/3468681 - Permissions Required
References () https://url.sap/sapsecuritypatchday - () https://url.sap/sapsecuritypatchday - Vendor Advisory

09 Jul 2024, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-09 04:15

Updated : 2024-08-29 19:29

NVD link : CVE-2024-34685

Mitre link : CVE-2024-34685

JSON object : View

Products Affected

sap

  • netweaver_knowledge_management_and_collaboration_\(kmc-cm\)
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')