PT-2023-22160 · Sap · Sap Application Interface

Publicado 2023-04-11 · Atualizado 2023-04-18 · CVE-2023-29112

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Application Interface (Message Monitoring) versions 600, 700

Description The issue allows an authorized attacker to input links or headings with custom CSS classes into a comment, which will render links and custom CSS classes as HTML objects. After successful exploitation, an attacker can cause limited impact on the confidentiality and integrity of the application.

Recommendations For versions 600 and 700, consider restricting the ability to input custom CSS classes into comments to minimize the risk of exploitation. As a temporary workaround, consider disabling the rendering of HTML objects in comments until a patch is available. Restrict access to the comment feature in the SAP Application Interface (Message Monitoring) to authorized personnel only to reduce the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-80

CWE-79

Identificadores relacionados

CVE-2023-29112

Produtos afetados

Sap Application Interface

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-29112 · Nota de Segurança
• https://launchpad.support.sap.com/#/notes/3114489 · Nota
• https://t.me/cvenotify/47965 · Publicação no Telegram
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-29112 · Aviso do Fabricante
• https://t.me/cibsecurity/61818 · Publicação no Telegram