PT-2023-20650 · Sap · Sap Content Server

Published 2023-03-14 · Updated 2023-11-02 · CVE-2023-26457

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Content Server version 7.53

Description The issue results from insufficient encoding of user-controlled inputs, leading to a Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can read and modify some sensitive information but cannot delete the data.

Recommendations For SAP Content Server version 7.53, consider implementing proper input encoding to prevent Cross-Site Scripting (XSS) attacks. As a temporary workaround, restrict access to sensitive information and monitor for any suspicious activity. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-26457

Affected Products

Sap Content Server

References · 9

• https://osv.dev/vulnerability/CVE-2023-26457 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26457 · Security Note
• https://t.me/rnetsec/19543 · Telegram Post
• https://t.me/secharvester/14649 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3281484 · Note
• https://twitter.com/cyberoux/status/1720033592619807016 · Twitter Post
• https://t.me/defcon_news/119417 · Telegram Post
• https://t.me/cibsecurity/59950 · Telegram Post