CVE-2024-44120CWE-79

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

Medium · published September 10, 2024

CVSS v3.1
4.7
EPSS
0%
Percentile
15.4
In the wild
Unconfirmed
What it is

SAP NetWeaver Enterprise Portal is vulnerable to reflected cross site scripting due to insufficient encoding of user-controlled input. An unauthenticated attacker could craft a malicious URL and trick a user to click it. If the victim clicks on this crafted URL before it times out, then the attacker could read and manipulate user content in the browser.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00249 · 15.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-09-10T04:26Z
EPSS history
Timeline
  • 10 SEP 04:26Z
    Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal
    cvelistv5