cnvd - cnvd-2024-10201

CNVD-2024-10201

Vulnerability from cnvd - Published: 2024-02-22

Title

SAP NetWeaver ABAP Server跨站脚本漏洞（CNVD-2024-10201）

Description

SAP NetWeaver ABAP Server是德国思爱普（SAP）公司的一个用作SAP产品的Web应用程序服务器。 SAP NetWeaver ABAP Server存在跨站脚本漏洞，该漏洞源于未对用户控制的输入进行充分编码，从而导致跨站脚本(XSS)漏洞。低权限的攻击者可利用该漏洞对应用程序数据的机密性造成的影响有限。

Severity

中

Patch Name

SAP NetWeaver ABAP Server跨站脚本漏洞（CNVD-2024-10201）的补丁

Patch Description

Formal description

厂商已提供漏洞修复方案，请关注厂商主页更新： https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364

Reference

https://nvd.nist.gov/vuln/detail/CVE-2024-21738

Impacted products

Name
['SAP Netweaver Application Server ABAP 756', 'SAP Netweaver Application Server ABAP 753', 'SAP Netweaver Application Server ABAP 754', 'SAP Netweaver Application Server ABAP 755', 'SAP Netweaver Application Server ABAP 750', 'SAP Netweaver Application Server ABAP 752', 'SAP Netweaver Application Server ABAP 740', 'SAP Netweaver Application Server ABAP 751', 'SAP Netweaver Application Server ABAP 757', 'SAP Netweaver Application Server ABAP 702', 'SAP Netweaver Application Server ABAP 700', 'SAP Netweaver Application Server ABAP 731', 'SAP Netweaver Application Server ABAP 701', 'SAP Netweaver Application Server ABAP 758', 'SAP Netweaver Application Server ABAP 793', 'SAP Netweaver Application Server ABAP 79']

Name

['SAP Netweaver Application Server ABAP 756', 'SAP Netweaver Application Server ABAP 753', 'SAP Netweaver Application Server ABAP 754', 'SAP Netweaver Application Server ABAP 755', 'SAP Netweaver Application Server ABAP 750', 'SAP Netweaver Application Server ABAP 752', 'SAP Netweaver Application Server ABAP 740', 'SAP Netweaver Application Server ABAP 751', 'SAP Netweaver Application Server ABAP 757', 'SAP Netweaver Application Server ABAP 702', 'SAP Netweaver Application Server ABAP 700', 'SAP Netweaver Application Server ABAP 731', 'SAP Netweaver Application Server ABAP 701', 'SAP Netweaver Application Server ABAP 758', 'SAP Netweaver Application Server ABAP 793', 'SAP Netweaver Application Server ABAP 79']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-21738",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21738"
    }
  },
  "description": "SAP NetWeaver ABAP Server\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u7528\u4f5cSAP\u4ea7\u54c1\u7684Web\u5e94\u7528\u7a0b\u5e8f\u670d\u52a1\u5668\u3002\n\nSAP NetWeaver ABAP Server\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u672a\u5bf9\u7528\u6237\u63a7\u5236\u7684\u8f93\u5165\u8fdb\u884c\u5145\u5206\u7f16\u7801\uff0c\u4ece\u800c\u5bfc\u81f4\u8de8\u7ad9\u811a\u672c(XSS)\u6f0f\u6d1e\u3002\u4f4e\u6743\u9650\u7684\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bf9\u5e94\u7528\u7a0b\u5e8f\u6570\u636e\u7684\u673a\u5bc6\u6027\u9020\u6210\u7684\u5f71\u54cd\u6709\u9650\u3002",
  "formalWay": "\u5382\u5546\u5df2\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-10201",
  "openTime": "2024-02-22",
  "patchDescription": "SAP NetWeaver ABAP Server\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u7528\u4f5cSAP\u4ea7\u54c1\u7684Web\u5e94\u7528\u7a0b\u5e8f\u670d\u52a1\u5668\u3002\r\n\r\nSAP NetWeaver ABAP Server\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u672a\u5bf9\u7528\u6237\u63a7\u5236\u7684\u8f93\u5165\u8fdb\u884c\u5145\u5206\u7f16\u7801\uff0c\u4ece\u800c\u5bfc\u81f4\u8de8\u7ad9\u811a\u672c(XSS)\u6f0f\u6d1e\u3002\u4f4e\u6743\u9650\u7684\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bf9\u5e94\u7528\u7a0b\u5e8f\u6570\u636e\u7684\u673a\u5bc6\u6027\u9020\u6210\u7684\u5f71\u54cd\u6709\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "SAP NetWeaver ABAP Server\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2024-10201\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "SAP Netweaver Application Server ABAP 756",
      "SAP Netweaver Application Server ABAP 753",
      "SAP Netweaver Application Server ABAP 754",
      "SAP Netweaver Application Server ABAP 755",
      "SAP Netweaver Application Server ABAP 750",
      "SAP Netweaver Application Server ABAP 752",
      "SAP Netweaver Application Server ABAP 740",
      "SAP Netweaver Application Server ABAP 751",
      "SAP Netweaver Application Server ABAP 757",
      "SAP Netweaver Application Server ABAP 702",
      "SAP Netweaver Application Server ABAP 700",
      "SAP Netweaver Application Server ABAP 731",
      "SAP Netweaver Application Server ABAP 701",
      "SAP Netweaver Application Server ABAP 758",
      "SAP Netweaver Application Server ABAP 793",
      "SAP Netweaver Application Server ABAP 79"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2024-21738",
  "serverity": "\u4e2d",
  "submitTime": "2024-01-12",
  "title": "SAP NetWeaver ABAP Server\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2024-10201\uff09"
}

CVE-2024-21738 (GCVE-0-2024-21738)

Vulnerability from cvelistv5 – Published: 2024-01-09 01:19 – Updated: 2025-06-03 14:33

Summary

SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker with low privileges can cause limited impact to confidentiality of the application data after successful exploitation.

Severity ?

4.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

sap

References

URL

Tags

	https://me.sap.com/notes/3387737
	https://www.sap.com/documents/2022/02/fa865ea4-16…

Impacted products

	Vendor	Product	Version
	SAP_SE	SAP NetWeaver ABAP Application Server and ABAP Platform	Affected: SAP_BASIS 700 Affected: SAP_BASIS 701 Affected: SAP_BASIS 702 Affected: SAP_BASIS 731 Affected: SAP_BASIS 740 Affected: SAP_BASIS 750 Affected: SAP_BASIS 751 Affected: SAP_BASIS 752 Affected: SAP_BASIS 753 Affected: SAP_BASIS 754 Affected: SAP_BASIS 755 Affected: SAP_BASIS 756 Affected: SAP_BASIS 757 Affected: SAP_BASIS 758 Affected: SAP_BASIS 793 Affected: SAP_BASIS 794

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:27:35.894Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://me.sap.com/notes/3387737"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21738",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T15:56:36.439121Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-03T14:33:28.278Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP NetWeaver ABAP Application Server and ABAP Platform",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_BASIS 700"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 701"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 702"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 731"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 740"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 750"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 751"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 752"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 753"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 754"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 755"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 756"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 757"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 758"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 793"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 794"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.\u00a0An attacker with low privileges can cause limited impact to confidentiality of the application data after successful exploitation.\u003c/p\u003e"
            }
          ],
          "value": "SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.\u00a0An attacker with low privileges can cause limited impact to confidentiality of the application data after successful exploitation.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "eng",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-09T01:19:29.437Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3387737"
        },
        {
          "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Application Server and ABAP Platform",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2024-21738",
    "datePublished": "2024-01-09T01:19:29.437Z",
    "dateReserved": "2024-01-01T10:54:59.645Z",
    "dateUpdated": "2025-06-03T14:33:28.278Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2024-10201

CVE-2024-21738 (GCVE-0-2024-21738)

Tags

Sightings

Nomenclature