CVE-2024-45278 — Cross-Site Scripting (XSS) vulnerability in SAP Commerce Backoffice

CVE-2024-45278

Cross-Site Scripting (XSS) vulnerability in SAP Commerce Backoffice PUBLISHED

Description (CNA)

SAP Commerce Backoffice does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP Commerce Backoffice	affected HY_COM 2205; affected COM_CLOUD 2211

CWE

CWE-79

References

https://me.sap.com/notes/3507545
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.