Vulnerability record · CVE-2024-27902 · published 12 March 2024
CVE-2024-27902: Sap netweaver as abap cross-site scripting vulnerability
Sap · Netweaver As Abap
Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. A successful attack can allow a malicious attacker to access and modify data through their ability to execute code in a user’s browser. There is no impact on the availability of the system
Description
Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. A successful attack can allow a malicious attacker to access and modify data through their ability to execute code in a user’s browser. There is no impact on the availability of the system
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://me.sap.com/notes/3377979 | Permissions Required |
| https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 | Vendor Advisory |
| https://me.sap.com/notes/3377979 | Permissions Required |
| https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 | Vendor Advisory |
Track CVE-2024-27902 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-27902), CISA KEV, FIRST EPSS (scores of 2026-10-09). This page is refreshed as NVD updates the record.
