PT-2023-22946 · Sap · Sap Crm+1

Published 2023-05-09 · Updated 2023-05-15 · CVE-2023-30742

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP CRM (WebClient UI) versions S4FND 102 through S4FND 107, WEBCUIF 700 through WEBCUIF 801

Description The issue arises from insufficient encoding of user-controlled inputs, leading to a stored Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this by storing a malicious URL and tricking a victim into clicking on it, resulting in the execution of the attacker's script within the victim's session. This could allow the attacker to modify or read information from the victim's session.

Recommendations For SAP CRM (WebClient UI) versions S4FND 102 through S4FND 107, update to a version that properly encodes user-controlled inputs to prevent stored XSS attacks. For WEBCUIF versions 700 through 801, ensure that all user-controlled inputs are sufficiently encoded to mitigate the stored XSS vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-30742

Affected Products

Sap Crm

Webcuif

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-30742 · Security Note
• https://osv.dev/vulnerability/CVE-2023-30742 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3315971 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory