CVE-2024-37174

Custom CSS support option in SAP CRM WebClientUI does not sufficiently encode user-controlled inputs resulting in Cross-SiteScripting vulnerability. On successful exploitation an attacker can causelimited impact on confidentiality and integrity of the application.

CVE-2024-37175

SAP CRM WebClient does notperform necessary authorization check for an authenticated user, resulting inescalation of privileges. This could allow an attacker to access some sensitiveinformation.

CVE-2024-37173

Due to insufficient input validation, SAPCRM WebClient UI allows an unauthenticated attacker to craft a URL link whichembeds a malicious script. When a victim clicks on this link, the script willbe executed in the victim's browser giving the attacker the ability to accessand/or modify information w...

CVE-2024-39598

SAP CRM (WebClient UI Framework) allows anauthenticated attacker to enumerate accessible HTTP endpoints in the internalnetwork by specially crafting HTTP requests. On successful exploitation thiscan result in information disclosure. It has no impact on integrity andavailability of the application.