CVE-2023-27499
CVSS V2 None
CVSS V3 None
Description
SAP GUI for HTML - versions KERNEL 7.22, 7.53, 7.54, 7.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT does not sufficiently encode user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could craft a malicious URL and lure the victim to click, the script supplied by the attacker will execute in the victim user's browser. The information from the victim's web browser can either be modified or read and sent to the attacker.
Overview
- CVE ID
- CVE-2023-27499
- Assigner
- cna@sap.com
- Vulnerability Status
- Analyzed
- Published Version
- 2023-04-11T03:15:07
- Last Modified Date
- 2023-04-18T16:02:19
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:sap:netweaver:7.22ext:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:sap:netweaver_application_server_abap:7.22:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:sap:netweaver_application_server_abap:7.53:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:sap:netweaver_application_server_abap:7.54:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:sap:netweaver_application_server_abap:7.77:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:sap:netweaver_application_server_abap:7.81:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:sap:netweaver_application_server_abap:7.85:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:sap:netweaver_application_server_abap:7.89:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:sap:netweaver_application_server_abap:7.91:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.22:*:*:*:*:*:*:* | 1 | OR |
References
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2023-27499 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27499 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2023-04-17 04:28:15 | Added to TrackCVE | |||
| 2023-04-17 04:28:18 | Weakness Enumeration | new | ||
| 2023-04-18 19:00:32 | 2023-04-18T16:02:19 | CVE Modified Date | updated | |
| 2023-04-18 19:00:32 | Undergoing Analysis | Analyzed | Vulnerability Status | updated |
| 2023-04-18 19:00:36 | CPE Information | updated |