CVE-2024-44120

SAP NetWeaver Enterprise Portal is vulnerable to reflected cross site scripting due to insufficient encoding of user-controlled input. An unauthenticated attacker could craft a malicious URL and trick a user to click it. If the victim clicks on this crafted URL before it times out, then the attacker could read and manipulate user content in the browser.

• CWE-79

• https://me.sap.com/notes/3498221
• https://url.sap/sapsecuritypatchday

Published

Sep 10, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-44112Due to missing authorization check in SAP for Oil & Gas (Tra…4.3
• CVE-2024-44113Due to missing authorization checks, SAP Business Warehouse …4.3
• CVE-2024-44114SAP NetWeaver Application Server for ABAP and ABAP Platform …2.7
• CVE-2024-44115The RFC enabled function module allows a low privileged user…4.3
• CVE-2024-44116The RFC enabled function module allows a low privileged user…4.3
• CVE-2024-44117The RFC enabled function module allows a low privileged user…5.4
• CVE-2024-44121Under certain conditions Statutory Reports in SAP S/4 HANA a…4.3
• CVE-2024-44122A logic issue was addressed with improved checks. This issue…8.8
• CVE-2024-44123A permissions issue was addressed with additional restrictio…2.3
• CVE-2024-44124This issue was addressed through improved state management. …6.5
• CVE-2024-44125The issue was addressed with improved checks. This issue is …5.5
• CVE-2024-44126The issue was addressed with improved checks. This issue is …7.8