CVE-2026-24323
Severity CVSS v4.0:
Pending analysis
Type:
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')
Publication date:
10/02/2026
Last modified:
17/02/2026
Description
The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sanitized. When a victim accesses a crafted URL, the injected script is executed in the victim�s browser, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.
Impact
Base Score 3.x
6.10
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:sap:document_management_system:600:*:*:*:*:*:*:* | ||
| cpe:2.3:a:sap:document_management_system:602:*:*:*:*:*:*:* | ||
| cpe:2.3:a:sap:document_management_system:603:*:*:*:*:*:*:* | ||
| cpe:2.3:a:sap:document_management_system:604:*:*:*:*:*:*:* | ||
| cpe:2.3:a:sap:document_management_system:605:*:*:*:*:*:*:* | ||
| cpe:2.3:a:sap:document_management_system:606:*:*:*:*:*:*:* | ||
| cpe:2.3:a:sap:document_management_system:617:*:*:*:*:*:*:* | ||
| cpe:2.3:a:sap:erp:618:*:*:*:*:*:*:* | ||
| cpe:2.3:a:sap:s4core:102:*:*:*:*:*:*:* | ||
| cpe:2.3:a:sap:s4core:103:*:*:*:*:*:*:* | ||
| cpe:2.3:a:sap:s4core:104:*:*:*:*:*:*:* | ||
| cpe:2.3:a:sap:s4core:105:*:*:*:*:*:*:* | ||
| cpe:2.3:a:sap:s4core:106:*:*:*:*:*:*:* | ||
| cpe:2.3:a:sap:s4core:107:*:*:*:*:*:*:* | ||
| cpe:2.3:a:sap:s4core:108:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page