CVE-2023-29188 — Cross-site Scripting in SE SAP CRM Webclient UI

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
5.4MEDIUMNVD
EPSS
0.4%
top 37.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
SAP SE SAP CRM Webclient UISAP Customer Relationship Management Webclient UISAP S4fnd+1 more
Timeline
PublishedMay 9

Description

SAP CRM WebClient UI - versions SAPSCORE 129, S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker with user level access can read and modify some sensitive information but cannot delete the data.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages4 packages

▶NVDsap/s4fnd7 versions+6
▶NVDsap/sapscore129
▶CVEListV5sap_se/sap_crm_webclient_ui14 versions+13

🔴Vulnerability Details

2
CVEList
Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI↗2023-05-09
▶
GHSA
GHSA-77j2-jh3v-5933: SAP CRM WebClient UI - versions SAPSCORE 129, S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746,↗2023-05-09
▶
CVE-2023-29188 — Cross-site Scripting | cvebase