CVE-2024-41735 - Vulnerability Details - OpenCVE

SAP Commerce Backoffice does not sufficiently
encode user-controlled inputs, resulting in Cross-Site Scripting (XSS)
vulnerability causing low impact on confidentiality and integrity of the
application.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00381.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Sap	Commerce Backoffice

Configuration 1 [-]

cpe:2.3:a:sap:commerce_backoffice:hy_com_2205:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://me.sap.com/notes/3483256
https://url.sap/sapsecuritypatchday

History

Thu, 12 Sep 2024 14:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Sap Sap commerce Backoffice
CPEs		cpe:2.3:a:sap:commerce_backoffice:hy_com_2205:::::::*
Vendors & Products		Sap Sap commerce Backoffice

Tue, 13 Aug 2024 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 13 Aug 2024 04:00:00 +0000

Type	Values Removed	Values Added
Description		SAP Commerce Backoffice does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability causing low impact on confidentiality and integrity of the application.
Title		Cross-Site Scripting (XSS) vulnerability in SAP Commerce Backoffice
Weaknesses		CWE-79
References		https://me.sap.com/notes/3483256 https://url.sap/sapsecuritypatchday
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: sap

Published: 2024-08-13T03:49:48.215Z

Updated: 2024-08-13T14:44:24.355Z

Reserved: 2024-07-22T08:06:52.677Z

Link: CVE-2024-41735

Vulnrichment

Updated: 2024-08-13T14:44:20.609Z

NVD

Status : Analyzed

Published: 2024-08-13T04:15:09.323

Modified: 2024-09-12T13:53:32.993

Link: CVE-2024-41735

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-41735", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2024-07-22T08:06:52.677Z", "datePublished": "2024-08-13T03:49:48.215Z", "dateUpdated": "2024-08-13T14:44:24.355Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SAP Commerce Backoffice", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "HY_COM 2205"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "SAP Commerce Backoffice does not sufficiently\nencode user-controlled inputs, resulting in Cross-Site Scripting (XSS)\nvulnerability causing low impact on confidentiality and integrity of the\napplication."}], "value": "SAP Commerce Backoffice does not sufficiently\nencode user-controlled inputs, resulting in Cross-Site Scripting (XSS)\nvulnerability causing low impact on confidentiality and integrity of the\napplication."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2024-08-13T03:49:48.215Z"}, "references": [{"url": "https://me.sap.com/notes/3483256"}, {"url": "https://url.sap/sapsecuritypatchday"}], "source": {"discovery": "UNKNOWN"}, "title": "Cross-Site Scripting (XSS) vulnerability in SAP Commerce Backoffice", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-13T14:44:14.587212Z", "id": "CVE-2024-41735", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-13T14:44:24.355Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-41735", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-13T14:44:14.587212Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-13T14:44:20.609Z"}}], "cna": {"title": "Cross-Site Scripting (XSS) vulnerability in SAP Commerce Backoffice", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Commerce Backoffice", "versions": [{"status": "affected", "version": "HY_COM 2205"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3483256"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "SAP Commerce Backoffice does not sufficiently\nencode user-controlled inputs, resulting in Cross-Site Scripting (XSS)\nvulnerability causing low impact on confidentiality and integrity of the\napplication.", "supportingMedia": [{"type": "text/html", "value": "SAP Commerce Backoffice does not sufficiently\nencode user-controlled inputs, resulting in Cross-Site Scripting (XSS)\nvulnerability causing low impact on confidentiality and integrity of the\napplication.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2024-08-13T03:49:48.215Z"}}}, "cveMetadata": {"cveId": "CVE-2024-41735", "state": "PUBLISHED", "dateUpdated": "2024-08-13T14:44:24.355Z", "dateReserved": "2024-07-22T08:06:52.677Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2024-08-13T03:49:48.215Z", "assignerShortName": "sap"}, "dataVersion": "5.1"}