CVE-2024-33007
Client-side script execution vulnerability in SAP UI5(PDFViewer)
Severity Score
3.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track
*SSVC
Descriptions
PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document contains embedded JavaScript (or any harmful client-side script), the PDFViewer will execute the JavaScript embedded in the PDF which can cause a potential security threat.
PDFViewer es un control entregado como parte del producto SAPUI5 que muestra el contenido del PDF en modo incrustado de forma predeterminada. Si un documento PDF contiene JavaScript incrustado (o cualquier script dañino del lado del cliente), PDFViewer ejecutará el JavaScript incrustado en el PDF, lo que puede causar una posible amenaza a la seguridad.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-04-23 CVE Reserved
- 2024-05-14 CVE Published
- 2024-05-14 EPSS Updated
- 2024-10-30 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
https://me.sap.com/notes/3446076 | ||
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
SAP SE Search vendor "SAP SE" | SAPUI5 (PDFViewer) Search vendor "SAP SE" for product "SAPUI5 (PDFViewer)" | 754 Search vendor "SAP SE" for product "SAPUI5 (PDFViewer)" and version "754" | en |
Affected
| ||||||
SAP SE Search vendor "SAP SE" | SAPUI5 (PDFViewer) Search vendor "SAP SE" for product "SAPUI5 (PDFViewer)" | 755 Search vendor "SAP SE" for product "SAPUI5 (PDFViewer)" and version "755" | en |
Affected
| ||||||
SAP SE Search vendor "SAP SE" | SAPUI5 (PDFViewer) Search vendor "SAP SE" for product "SAPUI5 (PDFViewer)" | 756 Search vendor "SAP SE" for product "SAPUI5 (PDFViewer)" and version "756" | en |
Affected
| ||||||
SAP SE Search vendor "SAP SE" | SAPUI5 (PDFViewer) Search vendor "SAP SE" for product "SAPUI5 (PDFViewer)" | 757 Search vendor "SAP SE" for product "SAPUI5 (PDFViewer)" and version "757" | en |
Affected
| ||||||
SAP SE Search vendor "SAP SE" | SAPUI5 (PDFViewer) Search vendor "SAP SE" for product "SAPUI5 (PDFViewer)" | 758 Search vendor "SAP SE" for product "SAPUI5 (PDFViewer)" and version "758" | en |
Affected
|