CVSS: 6.1EPSS: 0%CPEs: 14EXPL: 0CVE-2023-30742 – Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)
https://notcve.org/view.php?id=CVE-2023-30742
SAP CRM (WebClient UI) - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 700, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability.An attacker could store a malicious URL and lure the victim to click, causing the script supplied by the attacker to execute in the victim user's session. The information from the victim's session could then be modified or read by the attacker. • https://launchpad.support.sap.com/#/notes/3315971 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 13EXPL: 0CVE-2023-29189 – HTTP Verb Tampering vulnerability in SAP CRM (WebClient UI)
https://notcve.org/view.php?id=CVE-2023-29189
SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to modify HTTP verbs used in requests to the web server. This application is exposed over the network and successful exploitation can lead to exposure of form fields • https://launchpad.support.sap.com/#/notes/3269352 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html • CWE-23: Relative Path Traversal •
CVSS: 6.3EPSS: 0%CPEs: 5EXPL: 0CVE-2023-27897 – Code Injection vulnerability in SAP CRM
https://notcve.org/view.php?id=CVE-2023-27897
In SAP CRM - versions 700, 701, 702, 712, 713, an attacker who is authenticated with a non-administrative role and a common remote execution authorization can use a vulnerable interface to execute an application function to perform actions which they would not normally be permitted to perform. Depending on the function executed, the attack can can have limited impact on confidentiality and integrity of non-critical user or application data and application availability. • https://launchpad.support.sap.com/#/notes/3309056 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 0CVE-2021-33676
https://notcve.org/view.php?id=CVE-2021-33676
A missing authority check in SAP CRM, versions - 700, 701, 702, 712, 713, 714, could be leveraged by an attacker with high privileges to compromise confidentiality, integrity, or availability of the system. Una falta de comprobación de autoridad en SAP CRM, versiones - 700, 701, 702, 712, 713, 714, podría ser aprovechada por un atacante con altos privilegios para comprometer la confidencialidad, integridad o disponibilidad del sistema • https://launchpad.support.sap.com/#/notes/3066316 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 • CWE-862: Missing Authorization •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2017-15294
https://notcve.org/view.php?id=CVE-2017-15294
The Java administration console in SAP CRM has XSS. This is SAP Security Note 2478964. La consola de administración Java en SAP CRM tiene XSS. Esto corresponde con SAP Security Note 2478964. • http://www.securityfocus.com/bid/99532 https://blogs.sap.com/2017/07/11/sap-security-patch-day-july-2017 https://erpscan.io/advisories/erpscan-17-035-xss-crm-administration-console-java • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •