CVE-2026-24323
Undergoing Analysis Undergoing Analysis - In Progress
Cross-Site Scripting in BSP Applications via Unsanitized URL Parameters

Publication date: 2026-02-10

Last updated on: 2026-02-17

Assigner: SAP SE

Description
The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sanitized. When a victim accesses a crafted URL, the injected script is executed in the victimοΏ½s browser, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-10
Last Modified
2026-02-17
Generated
2026-06-16
AI Q&A
2026-02-10
EPSS Evaluated
2026-06-14
NVD
CVE-2026-24323
EUVD
EUVD-2026-6475
Affected Vendors & Products
Showing 15 associated CPEs
Vendor Product Version / Range
sap erp 618
sap s4core 102
sap s4core 103
sap s4core 104
sap s4core 105
sap s4core 106
sap s4core 107
sap s4core 108
sap document_management_system 600
sap document_management_system 603
sap document_management_system 604
sap document_management_system 605
sap document_management_system 606
sap document_management_system 617
sap document_management_system 602
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in BSP applications where an unauthenticated user can inject malicious script content through URL parameters that are not properly sanitized.

When a victim clicks on or accesses a specially crafted URL containing this malicious script, the script executes in the victim's browser.

Impact Analysis

The impact of this vulnerability is a low impact on confidentiality and integrity because the injected script can potentially access or manipulate some data in the victim's browser.

There is no impact on the availability of the application.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24323. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart