CVE-2024-47594

SAP NetWeaver Enterprise Portal (KMC) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability in KMC servlet. An attacker could craft a script and trick the user into clicking it. When a victim who is registered on the portal clicks on such link, confidentiality and integrity of their web browser session could be compromised.

• CWE-79

• https://me.sap.com/notes/3503462Permissions Required
• https://url.sap/sapsecuritypatchdayVendor Advisory

Published

Oct 8, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-47587Cash Operations does not perform necessary authorization che…3.5
• CVE-2024-47588In SAP NetWeaver Java (Software Update Manager 1.1), under c…4.7
• CVE-2024-4759The Mime Types Extended WordPress plugin through 0.11 does n…5.5
• CVE-2024-47590An unauthenticated attacker can create a malicious link whic…8.8
• CVE-2024-47592SAP NetWeaver AS Java allows an unauthenticated attacker to …5.3
• CVE-2024-47593SAP NetWeaver Application Server ABAP allows an unauthentica…4.3
• CVE-2024-47595An attacker who gains local membership to sapsys group could…7.1
• CVE-2024-47596GStreamer is a library for constructing graphs of media-hand…7.5
• CVE-2024-47597GStreamer is a library for constructing graphs of media-hand…9.1
• CVE-2024-47598GStreamer is a library for constructing graphs of media-hand…9.1
• CVE-2024-47599GStreamer is a library for constructing graphs of media-hand…7.5
• CVE-2024-4760A voltage glitch during the startup of EEFC NVM controllers …6.3