PT-2023-21174 · Sap · Sap Gui For Html

Published 2023-04-11 · Updated 2023-04-18 · CVE-2023-27499

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP GUI for HTML versions 7.22 through 7.91, KRNL64UC, 7.22EXT

Description The issue arises from insufficient encoding of user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could craft a malicious URL and lure the victim to click, allowing the script supplied by the attacker to execute in the victim user's browser. This could lead to the modification or reading of information from the victim's web browser, which could then be sent to the attacker.

Recommendations For SAP GUI for HTML versions 7.22 through 7.91, KRNL64UC, 7.22EXT, consider disabling the processing of user-controlled inputs until a patch is available. Restrict access to the SAP GUI for HTML to minimize the risk of exploitation. Avoid using the SAP GUI for HTML for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-27499

Affected Products

Sap Gui For Html

References · 5

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27499 · Security Note
• https://osv.dev/vulnerability/CVE-2023-27499 · Vendor Advisory
• https://t.me/cvenotify/47973 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3275458 · Note