CVE-2024-37173

🗓️ 09 Jul 2024 03:57:15Reported by sapType

Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify information with no effect on availability of the application

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2024-37173	9 Jul 202406:48	–	circl
CNNVD	SAP CRM Cross-Site Scripting Vulnerability	9 Jul 202400:00	–	cnnvd
Cvelist	CVE-2024-37173 [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)	9 Jul 202403:57	–	cvelist
EUVD	EUVD-2024-36479	3 Oct 202520:07	–	euvd
NVD	CVE-2024-37173	9 Jul 202404:15	–	nvd
OSV	CVE-2024-37173	9 Jul 202404:15	–	osv
Positive Technologies	PT-2024-27355 · Sap · Sap Crm Webclient Ui	8 Jul 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-37173	23 May 202507:43	–	redhatcve
Vulnrichment	CVE-2024-37173 [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)	9 Jul 202403:57	–	vulnrichment

NVD

Vulners

Node

sap customer_relationship_management_s4fndMatch102

sap customer_relationship_management_s4fndMatch103

sap customer_relationship_management_s4fndMatch104

sap customer_relationship_management_s4fndMatch105

sap customer_relationship_management_s4fndMatch106

sap customer_relationship_management_s4fndMatch107

sap customer_relationship_management_s4fndMatch108

sap customer_relationship_management_webclient_uiMatch701

sap customer_relationship_management_webclient_uiMatch731

sap customer_relationship_management_webclient_uiMatch746

sap customer_relationship_management_webclient_uiMatch747

sap customer_relationship_management_webclient_uiMatch748

sap customer_relationship_management_webclient_uiMatch800

sap customer_relationship_management_webclient_uiMatch801

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP CRM WebClient UI",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "S4FND 102"
      },
      {
        "status": "affected",
        "version": "S4FND 103"
      },
      {
        "status": "affected",
        "version": "S4FND 104"
      },
      {
        "status": "affected",
        "version": "S4FND 105"
      },
      {
        "status": "affected",
        "version": "S4FND 106"
      },
      {
        "status": "affected",
        "version": "S4FND 107"
      },
      {
        "status": "affected",
        "version": "S4FND 108"
      },
      {
        "status": "affected",
        "version": "WEBCUIF 701"
      },
      {
        "status": "affected",
        "version": "WEBCUIF 731"
      },
      {
        "status": "affected",
        "version": "WEBCUIF 746"
      },
      {
        "status": "affected",
        "version": "WEBCUIF 747"
      },
      {
        "status": "affected",
        "version": "WEBCUIF 748"
      },
      {
        "status": "affected",
        "version": "WEBCUIF 800"
      },
      {
        "status": "affected",
        "version": "WEBCUIF 801"
      }
    ]
  }
]

Source	Link
url	www.url.sap/sapsecuritypatchday
me	www.me.sap.com/notes/3467377

17 Jun 2026 07:37Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.16.1

EPSS0.00266

SSVC

CWE-79