cbcvebase.
CVE-2023-29110
published 2023-04-11

CVE-2023-29110: The SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows…

PriorityP425medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.32%
24.4th percentile
The SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows the usage HTML tags. An authorized attacker can use some of the basic HTML codes such as heading, basic formatting and lists, then an attacker can inject images from the foreign domains. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application.

Affected

18 ranges
VendorProductVersion rangeFixed in
sapabap_platform——
sapabap_platform——
sapabap_platform——
sapapplication_interface_framework——
sapapplication_interface_framework——
sapapplication_interface_framework——
sapapplication_interface_framework——
sapapplication_interface_framework——
sapapplication_interface_framework——
sapapplication_interface_framework——
sapapplication_interface_framework——
sapapplication_interface_framework——
sapapplication_interface_framework——
sapapplication_interface_framework——
sapbasis——
sapbasis——
saps4core——
saps4core——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.