Medium severity6.1NVD Advisory· Published Mar 10, 2022· Updated Jun 17, 2026

CVE-2022-24399

Description

The SAP Focused Run (Real User Monitoring) - versions 200, 300, REST service does not sufficiently sanitize the input name of the file using multipart/form-data, resulting in Cross-Site Scripting (XSS) vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

SAP/Focused Run2 versions
cpe:2.3:a:sap:focused_run:200:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:sap:focused_run:200:*:*:*:*:*:*:*
- cpe:2.3:a:sap:focused_run:300:*:*:*:*:*:*:*
SAP/Focused Run (Real User Monitoring)llm-fuzzy
Range: 200, 300
SAP SE/SAP Focused Run (Real User Monitoring)v5
Range: < 200

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/167559/SAP-FRUN-2.00-3.00-Cross-Site-Scripting.htmlnvdExploitThird Party AdvisoryVDB Entry
seclists.org/fulldisclosure/2022/Jun/37nvdExploitMailing ListThird Party Advisory
dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htmnvdVendor Advisory
launchpad.support.sap.comnvdPermissions RequiredVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000