PT-2023-15955 · Sap · Sap Solution Manager

Published 2023-02-14 · Updated 2023-04-12 · CVE-2023-0024

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions SAP Solution Manager (BSP Application) version 720

Description The issue allows an authenticated attacker to craft a malicious link. When clicked by an unsuspecting user, this link can be used to read or modify some sensitive information or craft a payload which may restrict access to the desired resources, resulting in a Cross-Site Scripting issue.

Recommendations For SAP Solution Manager (BSP Application) version 720, consider disabling the feature that allows users to click on crafted links until a patch is available. Restrict access to sensitive information and resources to minimize the risk of exploitation. Avoid using the application until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-0024

Affected Products

Sap Solution Manager

References · 6

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3265846 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-0024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0024 · Security Note
• https://t.me/cibsecurity/58067 · Telegram Post
• https://t.me/cvenotify/48080 · Telegram Post