CVE-2024-47590 Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatcher
An attacker can exploit XSS in SAP Web Dispatcher to execute arbitrary code on the server via a malicious link clicked by an authenticated user.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-47590?
CVE-2024-47590 is a high-severity cross-site scripting vulnerability in SAP_SE SAP Web Dispatcher, published on 12 Nov 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the victim's browser (XXS) or transmitted to another server (SSRF) gives the attacker the ability to execute arbitrary code on the server fully compromising confidentiality, integrity and availability.
Weakness: CWE-791
Which versions are affected by CVE-2024-47590?
How do I fix CVE-2024-47590?
No fix has been published for CVE-2024-47590 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-47590 being exploited?
There is no known exploitation of CVE-2024-47590 in the wild and no public exploit code.
Sources
Also known as GHSA-5pj7-9h42-mfx3.