CVE-2023-29188
Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI
Severity Score
5.4
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
SAP CRM WebClient UI - versions SAPSCORE 129, S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker with user level access can read and modify some sensitive information but cannot delete the data.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-04-03 CVE Reserved
- 2023-05-09 CVE Published
- 2024-05-15 EPSS Updated
- 2024-08-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://i7p.wdf.sap.corp/sap/support/notes/3315979 | Broken Link |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html | 2023-05-12 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Sap Search vendor "Sap" | Customer Relationship Management Webclient Ui Search vendor "Sap" for product "Customer Relationship Management Webclient Ui" | 7.01 Search vendor "Sap" for product "Customer Relationship Management Webclient Ui" and version "7.01" | - |
Affected
| ||||||
| Sap Search vendor "Sap" | Customer Relationship Management Webclient Ui Search vendor "Sap" for product "Customer Relationship Management Webclient Ui" | 7.31 Search vendor "Sap" for product "Customer Relationship Management Webclient Ui" and version "7.31" | - |
Affected
| ||||||
| Sap Search vendor "Sap" | Customer Relationship Management Webclient Ui Search vendor "Sap" for product "Customer Relationship Management Webclient Ui" | 7.46 Search vendor "Sap" for product "Customer Relationship Management Webclient Ui" and version "7.46" | - |
Affected
| ||||||
| Sap Search vendor "Sap" | Customer Relationship Management Webclient Ui Search vendor "Sap" for product "Customer Relationship Management Webclient Ui" | 7.47 Search vendor "Sap" for product "Customer Relationship Management Webclient Ui" and version "7.47" | - |
Affected
| ||||||
| Sap Search vendor "Sap" | Customer Relationship Management Webclient Ui Search vendor "Sap" for product "Customer Relationship Management Webclient Ui" | 7.48 Search vendor "Sap" for product "Customer Relationship Management Webclient Ui" and version "7.48" | - |
Affected
| ||||||
| Sap Search vendor "Sap" | Customer Relationship Management Webclient Ui Search vendor "Sap" for product "Customer Relationship Management Webclient Ui" | 8.00 Search vendor "Sap" for product "Customer Relationship Management Webclient Ui" and version "8.00" | - |
Affected
| ||||||
| Sap Search vendor "Sap" | Customer Relationship Management Webclient Ui Search vendor "Sap" for product "Customer Relationship Management Webclient Ui" | 8.01 Search vendor "Sap" for product "Customer Relationship Management Webclient Ui" and version "8.01" | - |
Affected
| ||||||
| Sap Search vendor "Sap" | S4fnd Search vendor "Sap" for product "S4fnd" | 1.02 Search vendor "Sap" for product "S4fnd" and version "1.02" | - |
Affected
| ||||||
| Sap Search vendor "Sap" | S4fnd Search vendor "Sap" for product "S4fnd" | 102 Search vendor "Sap" for product "S4fnd" and version "102" | - |
Affected
| ||||||
| Sap Search vendor "Sap" | S4fnd Search vendor "Sap" for product "S4fnd" | 103 Search vendor "Sap" for product "S4fnd" and version "103" | - |
Affected
| ||||||
| Sap Search vendor "Sap" | S4fnd Search vendor "Sap" for product "S4fnd" | 104 Search vendor "Sap" for product "S4fnd" and version "104" | - |
Affected
| ||||||
| Sap Search vendor "Sap" | S4fnd Search vendor "Sap" for product "S4fnd" | 105 Search vendor "Sap" for product "S4fnd" and version "105" | - |
Affected
| ||||||
| Sap Search vendor "Sap" | S4fnd Search vendor "Sap" for product "S4fnd" | 106 Search vendor "Sap" for product "S4fnd" and version "106" | - |
Affected
| ||||||
| Sap Search vendor "Sap" | S4fnd Search vendor "Sap" for product "S4fnd" | 107 Search vendor "Sap" for product "S4fnd" and version "107" | - |
Affected
| ||||||
| Sap Search vendor "Sap" | Sapscore Search vendor "Sap" for product "Sapscore" | 129 Search vendor "Sap" for product "Sapscore" and version "129" | - |
Affected
| ||||||