XSS in SAP Netweaver
CVE-2023-27499
SAP GUI for HTML - versions KERNEL 7.22, 7.53, 7.54, 7.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT does not sufficiently encode user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could craft a malicious URL and lure the victim to click, the script supplied by the attacker will execute in the victim user's browser. The information from the victim's web browser can either be modified or read and sent to the attacker.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.004 (36.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Sap Netweaver — versions 7.22ext
- Sap Netweaver_application_server_abap — versions 7.22, 7.53, 7.54
- Sap_se Gui For Html — versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@sap.com (Permissions Required)
- cna@sap.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-27499?
- CVE-2023-27499 is a medium-severity vulnerability in SAP Netweaver, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2023-04-11.
- How severe is CVE-2023-27499?
- Medium severity. CVSS v3 base score is 6.1 out of 10.
- Is CVE-2023-27499 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.