medium6.1
CVE-2024-37174
Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting vulnerability.
Impact
Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting vulnerability. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sap | Customer Relationship Management S4fnd | Versions 102, 103, 104, 105, 106, 107 |
| Sap | Customer Relationship Management Webclient Ui | Versions 701, 731, 746, 747, 748, 800 |