Cross-Site Scripting Vulnerability in SAP Customer Relationship Management Email Management
CVE-2019-0368

5.4MEDIUM

Key Information:

Vendor
SAP
Status
SAP Customer Relationship Management (email Management - S4crm)
SAP Customer Relationship Management (email Management - Bbpcrm)
Vendor
CVE Published:
8 October 2019

Summary

SAP Customer Relationship Management's Email Management feature exhibits a Cross-Site Scripting vulnerability due to inadequate encoding of user-controlled inputs. This deficiency allows attackers to inject malicious scripts, which could compromise the security of users accessing affected versions of the software. Organizations using SAP CRM versions listed should evaluate their systems and apply necessary security measures to mitigate this risk.

Affected Version(s)

SAP Customer Relationship Management (Email Management - BBPCRM) < 7.0 < 7.0

SAP Customer Relationship Management (Email Management - BBPCRM) < 7.01 < 7.01

SAP Customer Relationship Management (Email Management - BBPCRM) < 7.02 < 7.02

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_CONFIRM
https://launchpad.support.sap.com/#/notes/2751806
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.