Description
The application allows a high privilege attacker to append a malicious GET query parameter to Service invocations, which are reflected in the server response. Under certain circumstances, if the parameter contains a JavaScript, the script could be processed on client side.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SAP_SE | SAP Business Connector | 4.8 | — |
Advisories 1
- WID-SEC-2024-0811 SAP Patch Day April 2024: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 8, 2024