CVE-2024-47590: Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatcher
First published: Tue Nov 12 2024(Updated: )
An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the victim's browser (XXS) or transmitted to another server (SSRF) gives the attacker the ability to execute arbitrary code on the server fully compromising confidentiality, integrity and availability.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP Web Dispatcher |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-47590?
CVE-2024-47590 is classified with a high severity level due to its potential for unauthorized access and exploitation through cross-site scripting.
How do I fix CVE-2024-47590?
To fix CVE-2024-47590, apply the latest security patches provided by SAP for the Web Dispatcher.
What systems are affected by CVE-2024-47590?
CVE-2024-47590 affects SAP Web Dispatcher installations that have not been properly secured.
What type of vulnerability is CVE-2024-47590?
CVE-2024-47590 is a cross-site scripting (XSS) vulnerability that allows an attacker to execute scripts in the context of a victim's browser.
Who is at risk from CVE-2024-47590?
Authenticated users of SAP Web Dispatcher who click on malicious links are at risk from CVE-2024-47590.
- agent/title
- agent/references
- agent/first-publish-date
- agent/type
- agent/description
- agent/weakness
- agent/author
- agent/severity
- agent/event
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/sap
- canonical/sap web dispatcher