CVE-2023-24525

Published Feb 14, 2023

Last updated 2 years ago

Overview

Description: SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. On successful exploitation an authenticated attacker can cause limited impact on confidentiality of the application.
Source: cna@sap.com
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.4
Impact score: 2.7
Exploitability score: 2.3
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

cna@sap.com: CWE-79

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.00:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DE87D61B-2E55-4F32-8837-DD3D77FF7A89"
          },
          {
            "criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.01:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "314EA6B5-D3E3-4559-A34A-51A6BB4F3E12"
          },
          {
            "criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.02:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F6B9BEF2-5E40-465B-A728-484B6F9488E2"
          },
          {
            "criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.31:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "470B27E7-C245-43B3-9ED0-545A06158114"
          },
          {
            "criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.40:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D4E90CCA-F2D8-4EB3-A4F5-4705F7F8DB67"
          },
          {
            "criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.48:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A6CBB62D-FDA3-4A23-9175-B9171EA9CE7D"
          },
          {
            "criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.50:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EAF34241-C022-40FE-AB27-16D8EE537429"
          },
          {
            "criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.52:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6514BD40-D078-46D6-811C-B26E9692EF96"
          },
          {
            "criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:8.00:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1440F085-EB15-4910-8AB8-C72E67B8B39E"
          },
          {
            "criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:8.01:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F8D60B19-8578-40AF-9A09-5D6EB8D2DB40"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:sap:s4fnd:1.02:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3A88FFDD-4967-4E81-8E44-3F4A7BCCE943"
          },
          {
            "criteria": "cpe:2.3:a:sap:s4fnd:1.03:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "64D4BFFA-2E36-480B-83BB-199CB765659C"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

Weaknesses

Configurations

References