CVE-2024-33007 - Vulnerability Details - OpenCVE

PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document contains embedded JavaScript (or any harmful client-side script), the PDFViewer will execute the JavaScript embedded in the PDF which can cause a potential security threat.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Sap Se	Sapui5

No data.

No data.

References

Link	Providers
https://me.sap.com/notes/3446076
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html

History

Wed, 30 Oct 2024 19:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Sap Se Sap Se sapui5
CPEs		cpe:2.3:a:sap_se:sapui5::::::::
Vendors & Products		Sap Se Sap Se sapui5
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: sap

Published: 2024-05-14T03:44:05.434Z

Updated: 2024-10-30T18:34:02.458Z

Reserved: 2024-04-23T04:04:25.521Z

Link: CVE-2024-33007

Vulnrichment

Updated: 2024-08-02T02:27:53.283Z

NVD

Status : Awaiting Analysis

Published: 2024-05-14T16:17:14.693

Modified: 2024-11-21T09:16:13.297

Link: CVE-2024-33007

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-33007", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2024-04-23T04:04:25.521Z", "datePublished": "2024-05-14T03:44:05.434Z", "dateUpdated": "2024-10-30T18:34:02.458Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SAPUI5 (PDFViewer)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "754"}, {"status": "affected", "version": "755"}, {"status": "affected", "version": "756"}, {"status": "affected", "version": "757"}, {"status": "affected", "version": "758"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document contains embedded JavaScript (or any harmful client-side script), the PDFViewer will execute the JavaScript embedded in the PDF which can cause a potential security threat."}], "value": "PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document contains embedded JavaScript (or any harmful client-side script), the PDFViewer will execute the JavaScript embedded in the PDF which can cause a potential security threat."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2024-05-14T04:03:03.929Z"}, "references": [{"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"}, {"url": "https://me.sap.com/notes/3446076"}], "source": {"discovery": "UNKNOWN"}, "title": "Client-side script execution vulnerability in SAP UI5(PDFViewer)", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "affected": [{"vendor": "sap_se", "product": "sapui5", "cpes": ["cpe:2.3:a:sap_se:sapui5:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "754", "status": "affected"}, {"version": "755", "status": "affected"}, {"version": "756", "status": "affected"}, {"version": "757", "status": "affected"}, {"version": "758", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-05-14T19:07:47.432314Z", "id": "CVE-2024-33007", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-30T18:34:02.458Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:27:53.283Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html", "tags": ["x_transferred"]}, {"url": "https://me.sap.com/notes/3446076", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html", "tags": ["x_transferred"]}, {"url": "https://me.sap.com/notes/3446076", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:27:53.283Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-33007", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-14T19:07:47.432314Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:sap_se:sapui5:*:*:*:*:*:*:*:*"], "vendor": "sap_se", "product": "sapui5", "versions": [{"status": "affected", "version": "754"}, {"status": "affected", "version": "755"}, {"status": "affected", "version": "756"}, {"status": "affected", "version": "757"}, {"status": "affected", "version": "758"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-14T18:54:48.907Z"}}], "cna": {"title": "Client-side script execution vulnerability in SAP UI5(PDFViewer)", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAPUI5 (PDFViewer)", "versions": [{"status": "affected", "version": "754"}, {"status": "affected", "version": "755"}, {"status": "affected", "version": "756"}, {"status": "affected", "version": "757"}, {"status": "affected", "version": "758"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"}, {"url": "https://me.sap.com/notes/3446076"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document contains embedded JavaScript (or any harmful client-side script), the PDFViewer will execute the JavaScript embedded in the PDF which can cause a potential security threat.", "supportingMedia": [{"type": "text/html", "value": "PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document contains embedded JavaScript (or any harmful client-side script), the PDFViewer will execute the JavaScript embedded in the PDF which can cause a potential security threat.", "base64": false}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2024-05-14T04:03:03.929Z"}}}, "cveMetadata": {"cveId": "CVE-2024-33007", "state": "PUBLISHED", "dateUpdated": "2024-10-30T18:34:02.458Z", "dateReserved": "2024-04-23T04:04:25.521Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2024-05-14T03:44:05.434Z", "assignerShortName": "sap"}, "dataVersion": "5.1"}