XSS in SAP Abap Platform
CVE-2023-29110
The SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows the usage HTML tags. An authorized attacker can use some of the basic HTML codes such as heading, basic formatting and lists, then an attacker can inject images from the foreign domains. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application.
EPSS: 0.003 (24.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N.
Affected products
- Sap Abap_platform — versions 75c, 75d, 75e
- Sap Application_interface_framework — versions aif_703, aifx_702
- Sap Application Interface Framework (Message Dashboard) — versions AIF 703, AIFX 702, S4CORE 100
- Sap Basis — versions 755, 756
- Sap S4core — versions 100, 101
Weakness classification (CWE)
References
- cna@sap.com (Permissions Required)
- cna@sap.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-29110?
- CVE-2023-29110 is a low-severity vulnerability in SAP Abap Platform, classified under Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). CVSS score: 3.7/10. Published 2023-04-11.
- How severe is CVE-2023-29110?
- Low severity. CVSS v3 base score is 3.7 out of 10.