Lucene search

SapCVE-2024-30215

HistoryApr 09, 2024 - 1:15 a.m.

CVE-2024-30215

2024-04-0901:15:49

CWE-79

sap

web.nvd.nist.gov

resource settings

high privilege attacker

exploitable payload

information modification

potential attack

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

AI Score

6.2

Confidence

Low

EPSS

Percentile

9.0%

JSON

The Resource Settings page allows a high privilege attacker to load exploitable payload to be stored and reflected whenever a User visits the page. In a successful attack, some information could be obtained and/or modified. However, the attacker does not have control over what information is obtained, or the amount or kind of loss is limited.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP Business Connector",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "4.8"
      }
    ]
  }
]

References

me.sap.com/notes/3421453

support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364