CVE-2023-30742

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
6.1MEDIUM
EPSS
0.4%
top 36.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
SAP SE SAP CRM (webclient UI)SAP Customer Relationship Management S4fndSAP Customer Relationship Management Webclient UI
Timeline
PublishedMay 9

Description

SAP CRM (WebClient UI) - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 700, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability.An attacker could store a malicious URL and lure the victim to click, causing the script supplied by the attacker to execute in the victim user's session. The information from the …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5sap_se/sap_crm_(webclient_ui)14 versions+13

🔴Vulnerability Details

2
GHSA
GHSA-vprh-934g-cjhc: SAP CRM (WebClient UI) - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 700, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746↗2023-05-09
▶
CVEList
Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)↗2023-05-09
▶
CVE-2023-30742 (MEDIUM CVSS 6.1) | SAP CRM (WebClient UI) - versions S | cvebase.io