CVE-2023-24525: XSS
First published: Tue Feb 14 2023(Updated: )
SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. On successful exploitation an authenticated attacker can cause limited impact on confidentiality of the application.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sap Customer Relationship Management Webclient Ui | =7.00 | |
| Sap Customer Relationship Management Webclient Ui | =7.01 | |
| Sap Customer Relationship Management Webclient Ui | =7.02 | |
| Sap Customer Relationship Management Webclient Ui | =7.31 | |
| Sap Customer Relationship Management Webclient Ui | =7.40 | |
| Sap Customer Relationship Management Webclient Ui | =7.48 | |
| Sap Customer Relationship Management Webclient Ui | =7.50 | |
| Sap Customer Relationship Management Webclient Ui | =7.52 | |
| Sap Customer Relationship Management Webclient Ui | =8.00 | |
| Sap Customer Relationship Management Webclient Ui | =8.01 | |
| Sap S4fnd | =1.02 | |
| Sap S4fnd | =1.03 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-24525?
The severity of CVE-2023-24525 is medium with a CVSS score of 5.4.
Which versions of SAP CRM WebClient UI are affected by CVE-2023-24525?
Versions WEBCUIF 748, 800, 801, S4FND 102, 103 of SAP CRM WebClient UI are affected by CVE-2023-24525.
What is the impact of CVE-2023-24525?
Successful exploitation of CVE-2023-24525 can cause limited impact on the confidentiality of the application.
How can I fix or mitigate CVE-2023-24525?
To fix CVE-2023-24525, apply the necessary patches and updates provided by SAP.
Where can I find more information about CVE-2023-24525?
You can find more information about CVE-2023-24525 in the SAP Support Portal and the SAP security advisory.
- collector/nvd-index
- vendor/sap
- canonical/sap customer relationship management webclient ui
- version/sap customer relationship management webclient ui/7.00
- version/sap customer relationship management webclient ui/7.01
- version/sap customer relationship management webclient ui/7.02
- version/sap customer relationship management webclient ui/7.31
- version/sap customer relationship management webclient ui/7.40
- version/sap customer relationship management webclient ui/7.48
- version/sap customer relationship management webclient ui/7.50
- version/sap customer relationship management webclient ui/7.52
- version/sap customer relationship management webclient ui/8.00
- version/sap customer relationship management webclient ui/8.01
- canonical/sap s4fnd
- version/sap s4fnd/1.02
- version/sap s4fnd/1.03