Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) (SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML))

CVE-2026-76976
MEDIUM 5.4

En bref

Source
NVD
EPSS
EPSS 0.14 % · centile 3 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
sap
Statut NVD
Awaiting Analysis

Rechercher sur…

Description

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious scripts could be executed in the victim's browser context. This vulnerability has a low impact on the confidentiality and integrity of the data and no impact on the availability of the application.

Faiblesses (CWE)

  • CWE-79 — Injection de code indirecte (XSS)

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:Nsap
CVSS 3.1MEDIUM 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NNVD · cna@sap.com (Secondary)

Références européennes

Avis du CERT-FR

Produits affectés

ProduitVersions
SAP_SE · SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)affected SAP_BASIS 731 ; affected SAP_BASIS 740 ; affected SAP_BASIS 750 ; affected SAP_BASIS 751 ; affected SAP_BASIS 752 ; affected SAP_BASIS 753

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD