Reflected XSS in SAP GUI for HTML before 7.93
CVE-2023-27499 Published on April 11, 2023
Cross-Site Scripting (XSS) vulnerability in SAP GUI for HTML
SAP GUI for HTML - versions KERNEL 7.22, 7.53, 7.54, 7.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT does not sufficiently encode user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could craft a malicious URL and lure the victim to click, the script supplied by the attacker will execute in the victim user's browser. The information from the victim's web browser can either be modified or read and sent to the attacker.
Vulnerability Analysis
CVE-2023-27499 can be exploited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2023-27499 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2023-27499
stack.watch emails you whenever new vulnerabilities are published in SAP NetWeaver or SAP Netweaver Application Server Abap. Just hit a watch button to start following.
Affected Versions
SAP_SE GUI for HTML:- Version KERNEL 7.22 is affected.
- Version KERNEL 7.53 is affected.
- Version KERNEL 7.54 is affected.
- Version KERNEL 7.77 is affected.
- Version KERNEL 7.81 is affected.
- Version KERNEL 7.85 is affected.
- Version KERNEL 7.89 is affected.
- Version KERNEL 7.91 is affected.
- Version KRNL64UC 7.22 is affected.
- Version KRNL64UC 7.22EXT is affected.
- Version KRNL64UC 7.53 is affected.
- Version KRNL64NUC 7.22 is affected.
- Version KRNL64NUC 7.22EXT is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.