CVE-2024-45280

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confidentiality and integrity of the application. There is no impact on availability.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 10, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-452815.8SAP BusinessObjects Business Intelligence Platform allows a high privilege user to run client desktop applications even if some of the DLLs CVE-2024-452825.3Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified by MERGE method. The CVE-2024-452836.0SAP NetWeaver AS for Java allows an authorized attacker to obtain sensitive information. The attacker could obtain the username and passwordCVE-2024-452842.4An authenticated attacker with high privilege can use functions of SLCM transactions to which access should be restricted. This may result iCVE-2024-452855.4The RFC enabled function module allows a low privileged user to perform denial of service on any user and also change or delete favourite noCVE-2024-452866.5Due to lack of proper authorization checks when calling user, a function module in obsolete Tobin interface in SAP Production and Revenue AcCVE-2024-452877.5A malicious value of size in a structure of packed libnv can cause an integer overflow, leading to the allocation of a smaller buffer than rCVE-2024-452888.4A missing null-termination character in the last element of an nvlist array string can lead to writing outside the allocated buffer.CVE-2024-452897.5The fetch(3) library uses environment variables for passing certain information, including the revocation file pathname. The environment vaCVE-2024-45295.0The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in useCVE-2024-452907.5PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file whicCVE-2024-452918.8PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file that