Cross-Site Scripting Vulnerability in SAP Supplier Relationship Management
CVE-2019-0361

6.1MEDIUM

Key Information:

Vendor
SAP
Status
SAP Supplier Relationship Management (master Data Management Catalog) (srm Mdm Cat)
Vendor
CVE Published:
10 September 2019

Summary

SAP Supplier Relationship Management’s Master Data Management Catalog has a Cross-Site Scripting vulnerability due to insufficient encoding of user-controlled inputs, potentially allowing attackers to inject malicious scripts into web pages viewed by other users, compromising user data and application integrity.

Affected Version(s)

SAP Supplier Relationship Management (Master Data Management Catalog) (SRM_MDM_CAT) < 3.73 < 3.73

SAP Supplier Relationship Management (Master Data Management Catalog) (SRM_MDM_CAT) < 7.31 < 7.31

SAP Supplier Relationship Management (Master Data Management Catalog) (SRM_MDM_CAT) < 7.32 < 7.32

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_CONFIRM
https://launchpad.support.sap.com/#/notes/2820607
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.