CVE-2024-37178: Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation
First published: Tue Jun 11 2024(Updated: )
SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. These endpoints are exposed over the network. The vulnerability can exploit resources beyond the vulnerable component. On successful exploitation, an attacker can cause limited impact to confidentiality of the application.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP BusinessObjects Financial Consolidation |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-37178?
CVE-2024-37178 is classified as a Cross-Site Scripting (XSS) vulnerability in SAP Financial Consolidation.
How do I fix CVE-2024-37178?
To mitigate CVE-2024-37178, ensure that user-controlled inputs are properly encoded before being rendered on the web application.
What are the consequences of exploiting CVE-2024-37178?
Exploitation of CVE-2024-37178 may allow an attacker to execute arbitrary scripts in the context of the affected user’s session.
Which versions of SAP Financial Consolidation are affected by CVE-2024-37178?
SAP Financial Consolidation editions that do not properly encode user-controlled inputs are subject to CVE-2024-37178.
Is CVE-2024-37178 an external network vulnerability?
Yes, CVE-2024-37178 impacts endpoints exposed over the network, making it accessible to external threats.
- agent/weakness
- agent/title
- agent/references
- agent/first-publish-date
- agent/type
- agent/description
- agent/author
- agent/severity
- agent/event
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/sap
- canonical/sap businessobjects financial consolidation