PT-2023-31262 · Sap · Sap Hcm

Publicado 2023-12-11 · Atualizado 2023-12-19 · CVE-2023-49577

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP HCM (SMART PAYE solution) versions S4HCMCIE 100, SAP HRCIE 600, SAP HRCIE 604, SAP HRCIE 608

Description The SAP HCM (SMART PAYE solution) does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) issue. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.

Recommendations For versions S4HCMCIE 100, SAP HRCIE 600, SAP HRCIE 604, SAP HRCIE 608, consider implementing proper input encoding to prevent Cross-Site Scripting (XSS) attacks. As a temporary workaround, consider restricting user input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-49577

Produtos afetados

Sap Hcm

Referências · 8

• https://twitter.com/VulmonFeeds/status/1734462981134540809 · Publicação no Twitter
• https://t.me/cvenotify/63267 · Publicação no Telegram
• https://t.me/cvenotify/64140 · Publicação no Telegram
• https://me.sap.com/notes/3217087 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1734394499869393043 · Publicação no Twitter
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-49577 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-49577 · Nota de Segurança