PT-2023-31262 · Sap · Sap Hcm

Published 2023-12-11 · Updated 2023-12-19 · CVE-2023-49577

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP HCM (SMART PAYE solution) versions S4HCMCIE 100, SAP HRCIE 600, SAP HRCIE 604, SAP HRCIE 608

Description The SAP HCM (SMART PAYE solution) does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) issue. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.

Recommendations For versions S4HCMCIE 100, SAP HRCIE 600, SAP HRCIE 604, SAP HRCIE 608, consider implementing proper input encoding to prevent Cross-Site Scripting (XSS) attacks. As a temporary workaround, consider restricting user input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-49577

Affected Products

Sap Hcm

References · 8

• https://me.sap.com/notes/3217087 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49577 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49577 · Security Note
• https://twitter.com/VulmonFeeds/status/1734462981134540809 · Twitter Post
• https://t.me/cvenotify/63267 · Telegram Post
• https://t.me/cvenotify/64140 · Telegram Post
• https://twitter.com/CVEnew/status/1734394499869393043 · Twitter Post