CVE-2026-24325

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24325", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-01-21T22:15:36.673Z", "datePublished": "2026-02-10T03:04:30.133Z", "dateUpdated": "2026-02-10T16:16:25.107Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SAP BusinessObjects Enterprise (Central Management Console)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "ENTERPRISE 430"}, {"status": "affected", "version": "2025"}, {"status": "affected", "version": "2027"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an admin user to inject malicious JavaScript into a website and the injected script gets executed when the user visits the compromised page.This vulnerability has low impact on confidentiality and integrity of the data. There is no impact on the availability of the application.</p>"}], "value": "SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an admin user to inject malicious JavaScript into a website and the injected script gets executed when the user visits the compromised page.This vulnerability has low impact on confidentiality and integrity of the data. There is no impact on the availability of the application."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation", "lang": "eng", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-02-10T03:04:30.133Z"}, "references": [{"url": "https://me.sap.com/notes/3697256"}, {"url": "https://url.sap/sapsecuritypatchday"}], "source": {"discovery": "UNKNOWN"}, "title": "Cross Site Scripting (XSS) vulnerability in SAP BusinessObjects Enterprise (Central Management Console)", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-10T16:16:05.348857Z", "id": "CVE-2026-24325", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T16:16:25.107Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24325", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-10T16:16:05.348857Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T16:16:20.280Z"}}], "cna": {"title": "Cross Site Scripting (XSS) vulnerability in SAP BusinessObjects Enterprise (Central Management Console)", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP BusinessObjects Enterprise (Central Management Console)", "versions": [{"status": "affected", "version": "ENTERPRISE 430"}, {"status": "affected", "version": "2025"}, {"status": "affected", "version": "2027"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3697256"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an admin user to inject malicious JavaScript into a website and the injected script gets executed when the user visits the compromised page.This vulnerability has low impact on confidentiality and integrity of the data. There is no impact on the availability of the application.", "supportingMedia": [{"type": "text/html", "value": "<p>SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an admin user to inject malicious JavaScript into a website and the injected script gets executed when the user visits the compromised page.This vulnerability has low impact on confidentiality and integrity of the data. There is no impact on the availability of the application.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-02-10T03:04:30.133Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24325", "state": "PUBLISHED", "dateUpdated": "2026-02-10T16:16:25.107Z", "dateReserved": "2026-01-21T22:15:36.673Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-02-10T03:04:30.133Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP BusinessObjects Enterprise (Central Management Console)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "ENTERPRISE 430"}, {"status": "affected", "version": "2025"}, {"status": "affected", "version": "2027"}]}], "source": "cna@sap.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:businessobjects_enterprise:430:*:*:*:*:*:*:*", "matchCriteriaId": "0A72BBFB-83AF-444D-8FA1-D93461970A8C", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:businessobjects_enterprise:2025:*:*:*:*:*:*:*", "matchCriteriaId": "5E5C4FE2-06FF-4997-A9AC-3ECC22D86E67", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:businessobjects_enterprise:2027:*:*:*:*:*:*:*", "matchCriteriaId": "F9C0B64B-0C14-4297-96D9-85170D17FCBA", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an admin user to inject malicious JavaScript into a website and the injected script gets executed when the user visits the compromised page.This vulnerability has low impact on confidentiality and integrity of the data. There is no impact on the availability of the application."}, {"lang": "es", "value": "SAP BusinessObjects Enterprise no codifica suficientemente las entradas controladas por el usuario, lo que lleva a una vulnerabilidad de cross-site scripting (XSS) almacenado. Esto permite a un usuario administrador inyectar JavaScript malicioso en un sitio web y el script inyectado se ejecuta cuando el usuario visita la p\u00e1gina comprometida. Esta vulnerabilidad tiene bajo impacto en la confidencialidad e integridad de los datos. No hay impacto en la disponibilidad de la aplicaci\u00f3n."}], "id": "CVE-2026-24325", "lastModified": "2026-06-17T10:22:54.453", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24325", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-10T16:16:05.348857Z", "version": "2.0.3"}}]}, "published": "2026-02-10T04:16:04.790", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required"], "url": "https://me.sap.com/notes/3697256"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "ENTERPRISE 430"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2025"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2027"}}], "product": "sap_businessobjects_enterprise_(central_management_console)", "vendor": "sap_se"}], "analysis": {"en": {"generated_at": "2026-04-17T20:55:15.797762+00:00", "value": {"mitigation_remediation": ["Apply the SAP security patch identified in SAP Note 3697256 and released via the SAP Security Patch Day.", "Ensure that user input fields in the Central Management Console enforce proper encoding and validation to prevent arbitrary script storage.", "Restrict administrative privileges and conduct periodic reviews of stored content to detect and remove any injected scripts."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "SAP BusinessObjects Enterprise (Central Management Console) versions 2025, 2027, and 430 are impacted. No other version or product information is specified.", "description_and_impact": "SAP BusinessObjects Enterprise fails to properly encode user\u2011controlled inputs, enabling an administrator to embed malicious JavaScript that is stored and later executed when a visitor loads the compromised page. The attack provides the attacker with the ability to run code in the context of authenticated users who view the affected content; however, the documented impact on data confidentiality and integrity is low and there is no effect on application availability.", "risk_and_exploitability": "The vulnerability receives a CVSS score of 4.8, reflecting low severity, and an EPSS score of less than 1%. It is not listed in the CISA known exploded vulnerabilities catalog. Exploitation requires authenticated administrative access to inject and store the script, after which it is delivered to any user who views the altered page; the attack vector is therefore limited to privileged accounts rather than arbitrary unauthenticated users."}}}}, "created": "2026-02-10T11:34:37.445838+00:00", "updated": "2026-04-17T21:00:12.719594+00:00", "vendors": ["sap_se", "sap_se$PRODUCT$sap_businessobjects_enterprise_(central_management_console)"]}