CVE-2024-37174

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting vulnerability. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SAP_SE	SAP CRM WebClient UI	S4FND 102; S4FND 103; S4FND 104; S4FND 105; S4FND 106; S4FND 107; S4FND 108; WEBCUIF 701; WEBCUIF 731; WEBCUIF 746; WEBCUIF 747; WEBCUIF 748; WEBCUIF 800; WEBCUIF 801

References

https://me.sap.com/notes/3467377Permissions Required
https://url.sap/sapsecuritypatchdayVendor Advisory
https://me.sap.com/notes/3467377Permissions Required
https://url.sap/sapsecuritypatchdayVendor Advisory

Timeline

Published: Jul 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-371756.5SAP CRM WebClient does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This coul CVE-2024-371765.4SAP BW/4HANA Transformation and Data Transfer Process (DTP) allows an authenticated attacker to gain higher access levels than they should h CVE-2024-371778.1SAP Financial Consolidation allows data to enter a Web application through an untrusted source. These endpoints are exposed over the network CVE-2024-371785.0SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Thes CVE-2024-371796.5SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence CVE-2024-37185.4The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's widgets all CVE-2024-371805.3Under certain conditions SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to access remote-enabled function mo CVE-2024-371812.6Time-of-check time-of-use race condition in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user to CVE-2024-371826.1Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to CVE-2024-371837.5Plain text credentials and session ID can be captured with a network sniffer.CVE-2024-371847.2A buffer overflow vulnerability exists in the adm.cgi rep_as_bridge() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafte CVE-2024-371859.8in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds write.