{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-34686", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2024-05-07T05:46:11.657Z", "datePublished": "2024-06-11T02:11:49.630Z", "dateUpdated": "2024-08-02T02:59:22.207Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SAP CRM WebClient UI", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "S4FND 102"}, {"status": "affected", "version": "103"}, {"status": "affected", "version": "104"}, {"status": "affected", "version": "105"}, {"status": "affected", "version": "106"}, {"status": "affected", "version": "107"}, {"status": "affected", "version": "WEBCUIF 700"}, {"status": "affected", "version": "701"}, {"status": "affected", "version": "730"}, {"status": "affected", "version": "731"}, {"status": "affected", "version": "746"}, {"status": "affected", "version": "747"}, {"status": "affected", "version": "748"}, {"status": "affected", "version": "800"}, {"status": "affected", "version": "801"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Due to insufficient input validation, SAP CRM\nWebClient UI allows an unauthenticated attacker to craft a URL link which\nembeds a malicious script. When a victim clicks on this link, the script will\nbe executed in the victim's browser giving the attacker the ability to access\nand/or modify information with no effect on availability of the application.\n\n\n\n"}], "value": "Due to insufficient input validation, SAP CRM\nWebClient UI allows an unauthenticated attacker to craft a URL link which\nembeds a malicious script. When a victim clicks on this link, the script will\nbe executed in the victim's browser giving the attacker the ability to access\nand/or modify information with no effect on availability of the application."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2024-06-11T02:11:49.630Z"}, "references": [{"url": "https://me.sap.com/notes/3465129"}, {"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"}], "source": {"discovery": "UNKNOWN"}, "title": "Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "sap_se", "product": "sap_crm_webclient_ui", "cpes": ["cpe:2.3:a:sap_se:sap_crm_webclient_ui:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "S4FND 102", "status": "affected"}, {"version": "103", "status": "affected"}, {"version": "104", "status": "affected"}, {"version": "105", "status": "affected"}, {"version": "106", "status": "affected"}, {"version": "107", "status": "affected"}, {"version": "WEBCUIF 700", "status": "affected"}, {"version": "701", "status": "affected"}, {"version": "730", "status": "affected"}, {"version": "731", "status": "affected"}, {"version": "746", "status": "affected"}, {"version": "747", "status": "affected"}, {"version": "748", "status": "affected"}, {"version": "800", "status": "affected"}, {"version": "801", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-11T13:30:24.401872Z", "id": "CVE-2024-34686", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-11T13:41:52.606Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:59:22.207Z"}, "title": "CVE Program Container", "references": [{"url": "https://me.sap.com/notes/3465129", "tags": ["x_transferred"]}, {"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://me.sap.com/notes/3465129", "tags": ["x_transferred"]}, {"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:59:22.207Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-34686", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-11T13:30:24.401872Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:sap_se:sap_crm_webclient_ui:*:*:*:*:*:*:*:*"], "vendor": "sap_se", "product": "sap_crm_webclient_ui", "versions": [{"status": "affected", "version": "S4FND 102"}, {"status": "affected", "version": "103"}, {"status": "affected", "version": "104"}, {"status": "affected", "version": "105"}, {"status": "affected", "version": "106"}, {"status": "affected", "version": "107"}, {"status": "affected", "version": "WEBCUIF 700"}, {"status": "affected", "version": "701"}, {"status": "affected", "version": "730"}, {"status": "affected", "version": "731"}, {"status": "affected", "version": "746"}, {"status": "affected", "version": "747"}, {"status": "affected", "version": "748"}, {"status": "affected", "version": "800"}, {"status": "affected", "version": "801"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-11T13:36:49.062Z"}}], "cna": {"title": "Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP CRM WebClient UI", "versions": [{"status": "affected", "version": "S4FND 102"}, {"status": "affected", "version": "103"}, {"status": "affected", "version": "104"}, {"status": "affected", "version": "105"}, {"status": "affected", "version": "106"}, {"status": "affected", "version": "107"}, {"status": "affected", "version": "WEBCUIF 700"}, {"status": "affected", "version": "701"}, {"status": "affected", "version": "730"}, {"status": "affected", "version": "731"}, {"status": "affected", "version": "746"}, {"status": "affected", "version": "747"}, {"status": "affected", "version": "748"}, {"status": "affected", "version": "800"}, {"status": "affected", "version": "801"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3465129"}, {"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Due to insufficient input validation, SAP CRM\nWebClient UI allows an unauthenticated attacker to craft a URL link which\nembeds a malicious script. When a victim clicks on this link, the script will\nbe executed in the victim's browser giving the attacker the ability to access\nand/or modify information with no effect on availability of the application.", "supportingMedia": [{"type": "text/html", "value": "Due to insufficient input validation, SAP CRM\nWebClient UI allows an unauthenticated attacker to craft a URL link which\nembeds a malicious script. When a victim clicks on this link, the script will\nbe executed in the victim's browser giving the attacker the ability to access\nand/or modify information with no effect on availability of the application.\n\n\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2024-06-11T02:11:49.630Z"}}}, "cveMetadata": {"cveId": "CVE-2024-34686", "state": "PUBLISHED", "dateUpdated": "2024-08-02T02:59:22.207Z", "dateReserved": "2024-05-07T05:46:11.657Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2024-06-11T02:11:49.630Z", "assignerShortName": "sap"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:103:*:*:*:*:*:*:*", "matchCriteriaId": "D84BD4DE-15D9-4201-9A31-0A20F36D19AC", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:104:*:*:*:*:*:*:*", "matchCriteriaId": "E5511CFF-7BEF-46FE-BE5B-2445BC540BAE", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:105:*:*:*:*:*:*:*", "matchCriteriaId": "5295DFAB-ACDA-49DD-B2E6-07F6D4F3DC85", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:106:*:*:*:*:*:*:*", "matchCriteriaId": "99A1D12E-2E49-4C4A-9732-CCB2328AD838", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:107:*:*:*:*:*:*:*", "matchCriteriaId": "FE65B3D9-B97C-4016-B432-CD79F104BE6C", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:701:*:*:*:*:*:*:*", "matchCriteriaId": "2F220D25-9344-482A-A36C-9D743EA55DE8", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:730:*:*:*:*:*:*:*", "matchCriteriaId": "B0075805-C6FC-4E0D-9E1B-6ABA3A69F6C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:731:*:*:*:*:*:*:*", "matchCriteriaId": "48791122-7265-4C51-8AEB-DEBC199F9A7F", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:746:*:*:*:*:*:*:*", "matchCriteriaId": "B9EEA160-B4B4-45E9-84C8-C26E52D6F329", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:747:*:*:*:*:*:*:*", "matchCriteriaId": "8BDBE717-ADB6-4080-A198-E468080F82B2", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:748:*:*:*:*:*:*:*", "matchCriteriaId": "1B8775BD-EAB8-4F08-B65D-35B704C0E36B", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:800:*:*:*:*:*:*:*", "matchCriteriaId": "2BFCEADC-7359-470F-A412-5B2808CF6069", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:801:*:*:*:*:*:*:*", "matchCriteriaId": "A387786F-F4F6-44FC-B969-6FB92A1AA096", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:s4fnd_102:*:*:*:*:*:*:*", "matchCriteriaId": "115FB1F7-4C37-4519-AEEF-93E33FCEB745", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:webcuif_700:*:*:*:*:*:*:*", "matchCriteriaId": "757BEDCD-BB4D-4F29-B6D7-41861286122E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Due to insufficient input validation, SAP CRM\nWebClient UI allows an unauthenticated attacker to craft a URL link which\nembeds a malicious script. When a victim clicks on this link, the script will\nbe executed in the victim's browser giving the attacker the ability to access\nand/or modify information with no effect on availability of the application."}, {"lang": "es", "value": "Debido a una validaci\u00f3n de entrada insuficiente, la interfaz de usuario de SAP CRM WebClient permite que un atacante no autenticado cree un enlace URL que incorpore un script malicioso. Cuando una v\u00edctima hace clic en este enlace, el script se ejecutar\u00e1 en el navegador de la v\u00edctima, d\u00e1ndole al atacante la capacidad de acceder y/o modificar informaci\u00f3n sin ning\u00fan efecto sobre la disponibilidad de la aplicaci\u00f3n."}], "id": "CVE-2024-34686", "lastModified": "2024-11-21T09:19:11.657", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "cna@sap.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-06-11T03:15:11.080", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required"], "url": "https://me.sap.com/notes/3465129"}, {"source": "cna@sap.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required"], "url": "https://me.sap.com/notes/3465129"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}