PT-2023-4248 · Sap · Sap Netweaver Process Integration

Published 2023-08-08 · Updated 2023-08-15 · CVE-2023-37488

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Process Integration versions SAP XIESR 7.50, SAP XITOOL 7.50, SAP XIAF 7.50

Description The issue is related to insufficient encoding of user-controlled inputs, which could result in a Cross-Site Scripting (XSS) attack. On successful exploitation, the attacker can cause limited impact on confidentiality and integrity of the system.

Recommendations For SAP NetWeaver Process Integration versions SAP XIESR 7.50, SAP XITOOL 7.50, SAP XIAF 7.50, ensure that user-controlled inputs are sufficiently encoded to prevent Cross-Site Scripting (XSS) attacks. As a temporary workaround, consider implementing additional input validation and encoding mechanisms to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-04563

CVE-2023-37488

Affected Products

Sap Netweaver Process Integration

References · 7

• https://bdu.fstec.ru/vul/2023-04563 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-37488 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37488 · Security Note
• https://t.me/cibsecurity/67944 · Telegram Post
• https://blogs.sap.com/2023/08/08/sap-security-patch-day-august-2023 · Note
• https://me.sap.com/notes/3350494 · Note