Vulnerability · Published Nov 12, 2024 · Assigned by sap

CVE-2024-47590Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatcher

High 8.8

In plain English

A high-severity security flaw in SAP Web Dispatcher from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.8%top 42.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the victim's browser (XXS) or transmitted to another server (SSRF) gives the attacker the ability to execute arbitrary code on the server fully compromising confidentiality, integrity and availability.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP Web Dispatcher	WEBDISP 7.777.897.93KERNEL 7.779.129.13

Weakness: CWE-791 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References