PT-2023-22158 · Sap · Sap Application Interface

Publicado 2023-04-11 · Atualizado 2023-04-18 · CVE-2023-29110

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP BASIS 755, 756, SAP ABA 75C, 75D, 75E

Description The application allows the usage of HTML tags, enabling an authorized attacker to use basic HTML codes such as heading, basic formatting, and lists. This can lead to the injection of images from foreign domains. After successful exploitation, an attacker can cause limited impact on the confidentiality and integrity of the application.

Recommendations For versions AIF 703, AIFX 702, S4CORE 100, 101, SAP BASIS 755, 756, SAP ABA 75C, 75D, 75E, consider disabling the usage of HTML tags in the application as a temporary workaround until a patch is available. Restrict access to the Message Dashboard to minimize the risk of exploitation. Avoid using the application's image injection feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-80

CWE-79

Identificadores relacionados

CVE-2023-29110

Produtos afetados

Sap Application Interface

Referências · 5

• https://t.me/cvenotify/47967 · Publicação no Telegram
• https://launchpad.support.sap.com/#/notes/3113349 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-29110 · Nota de Segurança
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-29110 · Aviso do Fabricante