CVE-2024-34686
moderate-risk
Published 2024-06-11
Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify information with no effect on availability of the application.
Do I need to act?
-
0.63% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.1/10
Medium
NETWORK
/ LOW complexity
Affected Products (15)
Customer Relationship Management Webclient Ui
Customer Relationship Management Webclient Ui
Customer Relationship Management Webclient Ui
Customer Relationship Management Webclient Ui
Customer Relationship Management Webclient Ui
Customer Relationship Management Webclient Ui
Customer Relationship Management Webclient Ui
Customer Relationship Management Webclient Ui
Customer Relationship Management Webclient Ui
Customer Relationship Management Webclient Ui
Customer Relationship Management Webclient Ui
Customer Relationship Management Webclient Ui
Customer Relationship Management Webclient Ui
Customer Relationship Management Webclient Ui
Customer Relationship Management Webclient Ui
Affected Vendors
References (4)
Permissions Required
https://me.sap.com/notes/3465129
Permissions Required
https://me.sap.com/notes/3465129
43
/ 100
moderate-risk
Severity
23/34 · High
Exploitability
2/34 · Minimal
Exposure
18/34 · Moderate