The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sanitized. When a victim accesses a crafted URL, the injected script is executed in the victim�s browser, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.
References
| Link | Resource |
|---|---|
| https://me.sap.com/notes/3678417 | Permissions Required |
| https://url.sap/sapsecuritypatchday | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
17 Feb 2026, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Sap document Management System
Sap s4core Sap Sap erp |
|
| CPE | cpe:2.3:a:sap:document_management_system:605:*:*:*:*:*:*:* cpe:2.3:a:sap:document_management_system:602:*:*:*:*:*:*:* cpe:2.3:a:sap:s4core:108:*:*:*:*:*:*:* cpe:2.3:a:sap:s4core:105:*:*:*:*:*:*:* cpe:2.3:a:sap:s4core:107:*:*:*:*:*:*:* cpe:2.3:a:sap:s4core:102:*:*:*:*:*:*:* cpe:2.3:a:sap:s4core:103:*:*:*:*:*:*:* cpe:2.3:a:sap:document_management_system:603:*:*:*:*:*:*:* cpe:2.3:a:sap:document_management_system:606:*:*:*:*:*:*:* cpe:2.3:a:sap:s4core:106:*:*:*:*:*:*:* cpe:2.3:a:sap:document_management_system:617:*:*:*:*:*:*:* cpe:2.3:a:sap:s4core:104:*:*:*:*:*:*:* cpe:2.3:a:sap:document_management_system:604:*:*:*:*:*:*:* cpe:2.3:a:sap:erp:618:*:*:*:*:*:*:* cpe:2.3:a:sap:document_management_system:600:*:*:*:*:*:*:* |
|
| Summary |
|
|
| References | () https://me.sap.com/notes/3678417 - Permissions Required | |
| References | () https://url.sap/sapsecuritypatchday - Vendor Advisory |
10 Feb 2026, 04:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-10 04:16
Updated : 2026-02-17 15:15
NVD link : CVE-2026-24323
Mitre link : CVE-2026-24323
CVE.ORG link : CVE-2026-24323
JSON object : View
Products Affected
sap
- document_management_system
- erp
- s4core
CWE
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')