CVE-2024-37175

Technical details about CVE-2024-37175 are not provided in the connected documents. Available sources describe an authorization check failure in SAP CRM WebClient leading to privilege escalation, but do not specify affected versions, exploit methods, or fixes.

CVE-2023-24525

Summary: CVE-2023-24525 affects SAP CRM WebClient UI components (WEBCUIF 748, 800, 801; S4FND 102, 103). The vulnerability stems from insufficient encoding of user-controlled inputs, enabling a Cross-Site Scripting (XSS) flaw. In the documented entries, exploitation requires authentication and is...

CVE-2023-30742

Summary: CVE-2023-30742 is a stored XSS in SAP CRM (WebClient UI) affecting SAP CRM WebClient UI components: S4FND 102–107 and WEBCUIF 700–801. The root cause is insufficient encoding of user-controlled inputs, allowing an attacker to store a malicious URL and lure a victim into clicking it, exec...

CVE-2024-34686

CVE-2024-34686 concerns SAP CRM WebClient UI. The affected component is the SAP CRM WebClient UI, where insufficient input validation allows an unauthenticated attacker to craft a URL embedding a malicious script. When a victim clicks the link, the script runs in the victim’s browser, enabling th...

CVE-2024-37174

The CVE-2024-37174 entry concerns SAP CRM WebClient UI, where a Cross-Site Scripting vulnerability arises from insufficient encoding of user-controlled input in the Custom CSS support option. The issue affects the WebClient UI and can impact confidentiality and integrity to a limited degree, with...

CVE-2023-29188

The CVE-2023-29188 issue affects SAP CRM WebClient UI and related components: SAPSCORE 129, S4FND 102–107, WEBCUIF 701–801. The vulnerability is a Cross-Site Scripting (XSS) flaw caused by insufficient encoding of user-controlled inputs. Successful exploitation could allow a user with normal acce...

CVE-2019-0244

CVE-2019-0244 affects SAP CRM WebClient UI components (SAPSCORE, S4FND, WEBCUIF). The vulnerability arises from insufficient encoding of user-controlled inputs, enabling Cross-Site Scripting (XSS). Affected product areas: SAP CRM WebClient UI; fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.4...

CVE-2019-0245

SAP CRM WebClient UI is affected by a Cross-Site Scripting (XSS) vulnerability due to insufficient encoding of user-controlled inputs. The flaw affects SAPSCORE 1.12; S4FND 1.02; WEBCUIF components 7.31, 7.46, 7.47, 7.48, 8.0, and 8.01. The root cause is improper input encoding in the web client ...

CVE-2024-39598

CVE-2024-39598 affects SAP CRM (WebClient UI Framework). An authenticated attacker can enumerate accessible HTTP endpoints in the internal network by crafting specific HTTP requests, leading to information disclosure. The vulnerability impact is limited to confidentiality (information exposure); ...

CVE-2023-29189

CVE-2023-29189 affects SAP CRM (WebClient UI) across multiple versions (S4FND 102–107, WEBCUIF, 700–801). The root cause is an issue in the web server handling where HTTP verbs can be modified by an authenticated attacker, with the application exposed over the network. Consequence: exposure of fo...

CVE-2024-37173

CVE-2024-37173 affects SAP CRM WebClient UI. The issue is due to insufficient input validation that allows an unauthenticated attacker to craft a URL embedding a malicious script. When a user clicks the link, the script executes in the victim’s browser, enabling the attacker to access and/or modi...

CVE-2018-2364

The CVE-2018-2364 entry affects SAP CRM WebClient UI versions 7.01, 7.31, 7.46, 7.47, 7.48, 8.00, 8.01 and S4FND 1.02. The root cause is insufficient validation/encoding of hidden fields, leading to Cross-Site Scripting (XSS). The connected documents confirm the existence of the vulnerability but...