← Back

CVE-2026-24323

nvd nist
Published: Feb 10, 2026Modified: Jun 17, 2026

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.7
Source: CNA (Secondary)

Description

The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sanitized. When a victim accesses a crafted URL, the injected script is executed in the victim�s browser, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.

Affected (15)

Sap
3 products
Document Management System
Erp
S4core
Configuration A
15 vulnerable
Vulnerable SoftwareAffected Versions
Sap
Document Management System
Version 600
Document Management System
Version 602
Document Management System
Version 603
Document Management System
Version 604
Document Management System
Version 605
Document Management System
Version 606
Document Management System
Version 617
Erp
Version 618
Sap
S4core
Version 102
S4core
Version 103
S4core
Version 104
S4core
Version 105
S4core
Version 106
S4core
Version 107
S4core
Version 108

Related CWEs

CWE-601
URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (2)

Source: cna@sap.com
Permissions Required
Source: cna@sap.com
Vendor Advisory

Timeline

No history available yet.