PT-2023-21174 · Sap · Sap Gui For Html

Publicado 2023-04-11 · Atualizado 2023-04-18 · CVE-2023-27499

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP GUI for HTML versions 7.22 through 7.91, KRNL64UC, 7.22EXT

Description The issue arises from insufficient encoding of user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could craft a malicious URL and lure the victim to click, allowing the script supplied by the attacker to execute in the victim user's browser. This could lead to the modification or reading of information from the victim's web browser, which could then be sent to the attacker.

Recommendations For SAP GUI for HTML versions 7.22 through 7.91, KRNL64UC, 7.22EXT, consider disabling the processing of user-controlled inputs until a patch is available. Restrict access to the SAP GUI for HTML to minimize the risk of exploitation. Avoid using the SAP GUI for HTML for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-27499

Produtos afetados

Sap Gui For Html

Referências · 5

• https://t.me/cvenotify/47973 · Publicação no Telegram
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://launchpad.support.sap.com/#/notes/3275458 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-27499 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-27499 · Aviso do Fabricante