CVE-2024-34687: Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application server for ABAP and ABAP Platform

Published May 14, 2024

Updated

SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker can control code that is executed within a user’s browser, which could result in modification, deletion of data, including accessing or deleting files, or stealing session cookies which an attacker could use to hijack a user’s session. Hence, this could have impact on Confidentiality, Integrity and Availability of the system.

Affected Software

18 affected components

SAP NetWeaver Application Server for ABAP

SAP ABAP Platform

SAP SAP BASIS=700

SAP SAP BASIS=701

SAP SAP BASIS=702

SAP SAP BASIS=731

SAP SAP BASIS=740

SAP SAP BASIS=750

SAP SAP BASIS=751

SAP SAP BASIS=752

SAP SAP BASIS=753

SAP SAP BASIS=754

SAP SAP BASIS=755

SAP SAP BASIS=756

SAP SAP BASIS=757

SAP SAP BASIS=758

SAP SAP BASIS=795

SAP SAP BASIS=796

Remediation

Patch Available

https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html

Event History

May 14, 2024

CVE Published

via MITRE·03:56 AM

Data Sourced

via MITRE·03:56 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-34687?

CVE-2024-34687 has been classified as a medium severity vulnerability due to its potential impact on user data.

How do I fix CVE-2024-34687?

To fix CVE-2024-34687, prompt updates should be applied to the affected versions of SAP NetWeaver Application Server for ABAP and the ABAP Platform.

What type of vulnerability is CVE-2024-34687?

CVE-2024-34687 is a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code in the user's browser.

Who is affected by CVE-2024-34687?

CVE-2024-34687 affects users and administrators operating the SAP NetWeaver Application Server for ABAP and ABAP Platform.

What could be the impact of exploiting CVE-2024-34687?

Exploiting CVE-2024-34687 could result in the modification or deletion of user data, as well as the potential for session hijacking.