CVE-2023-24521
Assigner: sap
Published: 2023-02-14T03:16:44.948Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: NetWeaver AS ABAP (BSP Framework)
vendor: SAP
versions: status: affected
version: 700
status: affected
version: 701
status: affected
version: 702
status: affected
version: 731
status: affected
version: 740
status: affected
version: 750
status: affected
version: 751
status: affected
version: 752
status: affected
version: 753
status: affected
version: 754
status: affected
version: 755
status: affected
version: 756
status: affected
version: 757
descriptions: supportingMedia: base64: no
type: text/html
value: <p>Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an unauthenticated user to alter the current session of the user by injecting the malicious code over the network and gain access to the unintended data. This may lead to a limited impact on the confidentiality and the integrity of the application.</p>
value: Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an unauthenticated user to alter the current session of the user by injecting the malicious code over the network and gain access to the unintended data. This may lead to a limited impact on the confidentiality and the integrity of the application.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
type: CWE
source: discovery: UNKNOWN
x_generator: engine: Vulnogram 0.1.0-dev