CVE-2023-24525

SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. On successful exploitation an authenticated attacker can cause limited impact on confidentiality of the application.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.00:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.01:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.02:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.31:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.40:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.48:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.50:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.52:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:8.00:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:8.01:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:sap:s4fnd:1.02:*:*:*:*:*:*:*
cpe:2.3:a:sap:s4fnd:1.03:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-02-14 04:15

Updated : 2024-02-28 19:51


NVD link : CVE-2023-24525

Mitre link : CVE-2023-24525

CVE.ORG link : CVE-2023-24525


JSON object : View

Products Affected

sap

  • customer_relationship_management_webclient_ui
  • s4fnd
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')