CVE-2023-24525

5.4MEDIUM

Key Information:

Vendor
SAP
Status
CRM (WebClient UI)
Vendor
CVE Published:
14 February 2023

Summary

SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. On successful exploitation an authenticated attacker can cause limited impact on confidentiality of the application.

Affected Version(s)

CRM (WebClient UI) WEBCUIF 748

CRM (WebClient UI) 800

CRM (WebClient UI) 801

References

https://launchpad.support.sap.com/#/notes/2788178
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.