The User Admin application of SAP NetWeaver AS for Java - version 7.50, insufficiently validates and improperly encodes the incoming URL parameters before including them into the redirect URL. This results in Cross-Site Scripting (XSS) vulnerability, leading to a high impact on confidentiality and mild impact on integrity and availability.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.003.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Sap
  • Netweaver Application Server Java

Configuration 1 [-]

cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:*

No data.

No data.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-19722 The User Admin application of SAP NetWeaver AS for Java - version 7.50, insufficiently validates and improperly encodes the incoming URL parameters before including them into the redirect URL. This results in Cross-Site Scripting (XSS) vulnerability, leading to a high impact on confidentiality and mild impact on integrity and availability.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://me.sap.com/notes/3417627 cve-icon cve-icon
https://me.sap.com/notes/3557138 cve-icon cve-icon
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html cve-icon cve-icon
History

Sun, 13 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00309}

 epss

{'score': 0.00323}

Tue, 11 Feb 2025 05:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 11 Feb 2025 04:30:00 +0000

Type Values Removed Values Added
Description The User Admin application of SAP NetWeaver AS for Java - version 7.50, insufficiently validates and improperly encodes the incoming URL parameters before including them into the redirect URL. This results in Cross-Site Scripting (XSS) vulnerability, leading to a high impact on confidentiality and mild impact on integrity and availability. The User Admin application of SAP NetWeaver AS for Java - version 7.50, insufficiently validates and improperly encodes the incoming URL parameters before including them into the redirect URL. This results in Cross-Site Scripting (XSS) vulnerability, leading to a high impact on confidentiality and mild impact on integrity and availability.
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L'}

 cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Thu, 10 Oct 2024 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Sap
Sap netweaver Application Server Java
CPEs cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:*
Vendors & Products Sap
Sap netweaver Application Server Java
cve-icon MITRE

Status: PUBLISHED

Assigner: sap

Published:

Updated: 2025-02-11T04:13:01.325Z

Reserved: 2024-01-05T10:21:35.256Z

Link: CVE-2024-22126

cve-icon Vulnrichment

Updated: 2024-08-01T22:35:34.804Z

cve-icon NVD

Status : Modified

Published: 2024-02-13T02:15:08.107

Modified: 2025-02-11T05:15:13.300

Link: CVE-2024-22126

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.