XSS in SAP Abap Platform
CVE-2023-29110
The SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows the usage HTML tags. An authorized attacker can use some of the basic HTML codes such as heading, basic formatting and lists, then an attacker can inject images from the foreign domains. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.003 (23.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 23rd percentile — 23.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- SAP Abap Platform — versions 75c, 75d, 75e
- SAP Application Interface Framework — versions aif_703, aifx_702
- SAP Application Interface Framework (Message Dashboard) — versions AIF 703, AIFX 702, S4CORE 100
- SAP Basis — versions 755, 756
- SAP S4core — versions 100, 101
Weakness classification (CWE)
References
- launchpad.support.sap.com/ (Permissions Required)
- www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-29110?
- CVE-2023-29110 is a low-severity vulnerability in SAP Abap Platform, classified under Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). CVSS score: 3.7/10. Published 2023-04-11.
- How severe is CVE-2023-29110?
- Low severity. CVSS v3 base score is 3.7 out of 10.