CVE-2024-37178

SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. These endpoints are exposed over the network. The vulnerability can exploit resources beyond the vulnerable component. On successful exploitation, an attacker can cause limited impact to confidentiality of the application.

• CWE-79

• https://me.sap.com/notes/3457592
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
• https://me.sap.com/notes/3457592
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html

Published

Jun 11, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-37172SAP S/4HANA Finance (Advanced Payment Management) does not p…5.4
• CVE-2024-37173Due to insufficient input validation, SAP CRM WebClient UI…6.1
• CVE-2024-37174Custom CSS support option in SAP CRM WebClient UI does not s…6.1
• CVE-2024-37175SAP CRM WebClient does not perform necessary authorization c…6.5
• CVE-2024-37176SAP BW/4HANA Transformation and Data Transfer Process (DTP) …5.4
• CVE-2024-37177SAP Financial Consolidation allows data to enter a Web appli…8.1
• CVE-2024-37179SAP BusinessObjects Business Intelligence Platform allows an…6.5
• CVE-2024-3718The The Plus Addons for Elementor plugin for WordPress is vu…5.4
• CVE-2024-37180Under certain conditions SAP NetWeaver Application Server fo…5.3
• CVE-2024-37181Time-of-check time-of-use race condition in some Intel(R) Ne…2.6
• CVE-2024-37182Mattermost Desktop App versions <=5.7.0 fail to correctly pr…6.1
• CVE-2024-37183Plain text credentials and session ID can be captured with a…7.5