PT-2023-22946 · Sap · Sap Crm+1

CVE-2023-30742 · Publicado 2023-05-09 · Atualizado 2023-05-15

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP CRM (WebClient UI) versions S4FND 102 through S4FND 107, WEBCUIF 700 through WEBCUIF 801

Description The issue arises from insufficient encoding of user-controlled inputs, leading to a stored Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this by storing a malicious URL and tricking a victim into clicking on it, resulting in the execution of the attacker's script within the victim's session. This could allow the attacker to modify or read information from the victim's session.

Recommendations For SAP CRM (WebClient UI) versions S4FND 102 through S4FND 107, update to a version that properly encodes user-controlled inputs to prevent stored XSS attacks. For WEBCUIF versions 700 through 801, ensure that all user-controlled inputs are sufficiently encoded to mitigate the stored XSS vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-30742

Produtos afetados

Sap Crm

Webcuif

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-30742 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-30742 · Aviso do Fabricante
• https://launchpad.support.sap.com/#/notes/3315971 · Aviso do Fabricante
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante