CVE-2023-0021: Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver
Due to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password, which could lead to reflected Cross-Site scripting. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the application.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-0021?
CVE-2023-0021 is a vulnerability in SAP NetWeaver versions 700, 701, 702, 731, 740, and 750 that allows an unauthenticated attacker to inject code, potentially exposing sensitive data like user ID and password.
How can an attacker exploit CVE-2023-0021?
An attacker can exploit CVE-2023-0021 by injecting malicious code into user input, which, if not properly encoded, can lead to reflected Cross-Site Scripting (XSS) attacks.
What is the severity of CVE-2023-0021?
CVE-2023-0021 has a severity rating of 6.1 out of 10, classified as medium severity.
Which versions of SAP NetWeaver are affected by CVE-2023-0021?
Versions 700, 701, 702, 731, 740, and 750 of SAP NetWeaver are affected by CVE-2023-0021.
How can I mitigate the vulnerability CVE-2023-0021?
To mitigate the vulnerability CVE-2023-0021, it is recommended to apply the necessary patches and updates provided by SAP. Additionally, validating and properly encoding user input can help prevent code injection attacks.