CVE-2024-34686: Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)

Published Jun 11, 2024

Updated

Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify information with no effect on availability of the application.

Affected Software

15 affected components

SAP Customer Relationship Management Webclient Ui=103

SAP Customer Relationship Management Webclient Ui=104

SAP Customer Relationship Management Webclient Ui=105

SAP Customer Relationship Management Webclient Ui=106

SAP Customer Relationship Management Webclient Ui=107

SAP Customer Relationship Management Webclient Ui=701

SAP Customer Relationship Management Webclient Ui=730

SAP Customer Relationship Management Webclient Ui=731

SAP Customer Relationship Management Webclient Ui=746

SAP Customer Relationship Management Webclient Ui=747

SAP Customer Relationship Management Webclient Ui=748

SAP Customer Relationship Management Webclient Ui=800

SAP Customer Relationship Management Webclient Ui=801

SAP Customer Relationship Management Webclient Ui=s4fnd_102

SAP Customer Relationship Management Webclient Ui=webcuif_700

Remediation

Patch Available

https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html

Event History

Jun 11, 2024

CVE Published

via MITRE·02:11 AM

Data Sourced

via MITRE·02:11 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-34686?

CVE-2024-34686 is rated as critical due to its potential for exploitation via cross-site scripting (XSS).

How do I fix CVE-2024-34686?

To fix CVE-2024-34686, upgrade to the latest version of SAP CRM WebClient UI that addresses the insufficient input validation issues.

What software is affected by CVE-2024-34686?

CVE-2024-34686 affects specific versions of SAP CRM WebClient UI, including versions 103, 104, 105, 106, 107, and several others listed in the vulnerability report.

Who can exploit CVE-2024-34686?

CVE-2024-34686 can be exploited by unauthenticated attackers who can craft malicious URLs to execute scripts in victims' browsers.

What is the impact of CVE-2024-34686?

The impact of CVE-2024-34686 includes unauthorized access and manipulation of user data through executed scripts when users interact with affected links.