PT-2023-4248 · Sap · Sap Netweaver Process Integration

Publicado 2023-08-08 · Atualizado 2023-08-15 · CVE-2023-37488

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Process Integration versions SAP XIESR 7.50, SAP XITOOL 7.50, SAP XIAF 7.50

Description The issue is related to insufficient encoding of user-controlled inputs, which could result in a Cross-Site Scripting (XSS) attack. On successful exploitation, the attacker can cause limited impact on confidentiality and integrity of the system.

Recommendations For SAP NetWeaver Process Integration versions SAP XIESR 7.50, SAP XITOOL 7.50, SAP XIAF 7.50, ensure that user-controlled inputs are sufficiently encoded to prevent Cross-Site Scripting (XSS) attacks. As a temporary workaround, consider implementing additional input validation and encoding mechanisms to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2023-04563

CVE-2023-37488

Produtos afetados

Sap Netweaver Process Integration

Referências · 7

• https://bdu.fstec.ru/vul/2023-04563 · Nota de Segurança
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-37488 · Aviso do Fabricante
• https://t.me/cibsecurity/67944 · Publicação no Telegram
• https://blogs.sap.com/2023/08/08/sap-security-patch-day-august-2023 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-37488 · Nota de Segurança
• https://me.sap.com/notes/3350494 · Nota