CVE-2024-42378 — Cross-Site Scripting (XSS) in eProcurement on S/4HANA

Description (CNA)

Due to weak encoding of user-controlled inputs, eProcurement on SAP S/4HANA allows malicious scripts to be executed in the application, potentially leading to a Reflected Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the application, but it can have some minor impact on its confidentiality and integrity.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP S/4HANA eProcurement	affected SAP_APPL 606; affected SAP_APPL 617; affected SAP_APPL 618; affected S4CORE 102; affected S4CORE 103; affected S4CORE 104; affected S4CORE 105; affected S4CORE 106; affected S4CORE 107; affected S4CORE 108

CWE

CWE-79

References

https://me.sap.com/notes/3497347
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.