SAP NWBC for HTML - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious javascript to cause limited impact to confidentiality and integrity of the application data after successful exploitation.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.01258.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
SAP_SE SAP NetWeaver Business Client for HTML unaffected
Version Status Constraints
SAP_UI 754 affected
—
SAP_UI 755 affected
—
SAP_UI 756 affected
—
SAP_UI 757 affected
—
SAP_BASIS 700 affected
—
SAP_BASIS 701 affected
—
SAP_BASIS 702 affected
—
SAP_BASIS 731 affected
—

Configuration 1 [-]

OR cpe:2.3:a:sap:netweaver_business_client_for_html:sap_basis_700:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_business_client_for_html:sap_basis_701:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_business_client_for_html:sap_basis_702:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_business_client_for_html:sap_basis_731:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_business_client_for_html:sap_ui_754:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_business_client_for_html:sap_ui_755:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_business_client_for_html:sap_ui_756:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_business_client_for_html:sap_ui_757:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_business_client_for_html:sap_ui_758:*:*:*:*:*:*:*

No data.

No data.

Subscriptions

Vendors Products
Sap Subscribe
Netweaver Business Client For Html Subscribe
Sap Se Subscribe
Sap Netweaver Business Client For Html Subscribe

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-19724 SAP NWBC for HTML - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious javascript to cause limited impact to confidentiality and integrity of the application data after successful exploitation.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://me.sap.com/notes/3396109 cve-icon cve-icon
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html cve-icon cve-icon
History

Wed, 25 Feb 2026 10:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 25 Feb 2026 10:00:00 +0000

Type Values Removed Values Added
Description SAP NWBC for HTML - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious javascript to cause limited impact to confidentiality and integrity of the application data after successful exploitation. SAP NWBC for HTML - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious javascript to cause limited impact to confidentiality and integrity of the application data after successful exploitation.
First Time appeared Sap Se
Sap Se sap Netweaver Business Client For Html
CPEs cpe:2.3:a:sap_se:sap_netweaver_business_client_for_html:sap_basis_700:*:*:*:*:*:*:*
cpe:2.3:a:sap_se:sap_netweaver_business_client_for_html:sap_basis_701:*:*:*:*:*:*:*
cpe:2.3:a:sap_se:sap_netweaver_business_client_for_html:sap_basis_702:*:*:*:*:*:*:*
cpe:2.3:a:sap_se:sap_netweaver_business_client_for_html:sap_basis_731:*:*:*:*:*:*:*
cpe:2.3:a:sap_se:sap_netweaver_business_client_for_html:sap_ui_754:*:*:*:*:*:*:*
cpe:2.3:a:sap_se:sap_netweaver_business_client_for_html:sap_ui_755:*:*:*:*:*:*:*
cpe:2.3:a:sap_se:sap_netweaver_business_client_for_html:sap_ui_756:*:*:*:*:*:*:*
cpe:2.3:a:sap_se:sap_netweaver_business_client_for_html:sap_ui_757:*:*:*:*:*:*:*
Vendors & Products Sap Se
Sap Se sap Netweaver Business Client For Html

Wed, 16 Oct 2024 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Sap
Sap netweaver Business Client For Html
CPEs cpe:2.3:a:sap:netweaver_business_client_for_html:sap_basis_700:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_business_client_for_html:sap_basis_701:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_business_client_for_html:sap_basis_702:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_business_client_for_html:sap_basis_731:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_business_client_for_html:sap_ui_754:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_business_client_for_html:sap_ui_755:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_business_client_for_html:sap_ui_756:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_business_client_for_html:sap_ui_757:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_business_client_for_html:sap_ui_758:*:*:*:*:*:*:*
Vendors & Products Sap
Sap netweaver Business Client For Html
cve-icon MITRE

Status: PUBLISHED

Assigner: sap

Published:

Updated: 2026-02-25T09:45:44.998Z

Reserved: 2024-01-05T10:21:35.256Z

Link: CVE-2024-22128

cve-icon Vulnrichment

Updated: 2024-08-01T22:35:34.814Z

cve-icon NVD

Status : Modified

Published: 2024-02-13T02:15:08.323

Modified: 2026-02-25T10:16:17.483

Link: CVE-2024-22128

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses