CVE-2023-29188 - OpenCVE

SAP CRM WebClient UI - versions SAPSCORE 129, S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker with user level access can read and modify some sensitive information but cannot delete the data.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Sap	Sapscore S4fnd Customer Relationship Management Webclient Ui

Configuration 1 [-]

OR	cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.01:::::::*
	cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.31:::::::*
	cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.46:::::::*
	cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.47:::::::*
	cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.48:::::::*
	cpe:2.3:a:sap:customer_relationship_management_webclient_ui:8.00:::::::*
	cpe:2.3:a:sap:customer_relationship_management_webclient_ui:8.01:::::::*
	cpe:2.3:a:sap:s4fnd:1.02:::::::*
	cpe:2.3:a:sap:s4fnd:102:::::::*
	cpe:2.3:a:sap:s4fnd:103:::::::*
	cpe:2.3:a:sap:s4fnd:104:::::::*
	cpe:2.3:a:sap:s4fnd:105:::::::*
	cpe:2.3:a:sap:s4fnd:106:::::::*
	cpe:2.3:a:sap:s4fnd:107:::::::*
	cpe:2.3:a:sap:sapscore:129:::::::*

References

Link	Resource
https://i7p.wdf.sap.corp/sap/support/notes/3315979	Broken Link
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: sap

Published: 2023-05-09T00:57:57.055Z

Updated: 2023-05-09T00:57:57.055Z

Reserved: 2023-04-03T09:22:43.158Z

Link: CVE-2023-29188

JSON object: View

NVD Information

Status : Analyzed

Published: 2023-05-09T01:15:08.943

Modified: 2023-05-12T20:38:28.087

Link: CVE-2023-29188

JSON object: View

Redhat Information

No data.

CWE

CWE-79

{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-29188", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2023-04-03T09:22:43.158Z", "datePublished": "2023-05-09T00:57:57.055Z", "dateUpdated": "2023-05-09T00:57:57.055Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SAP CRM WebClient UI", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "SAPSCORE 129"}, {"status": "affected", "version": "S4FND 102"}, {"status": "affected", "version": "S4FND 103"}, {"status": "affected", "version": "S4FND 104"}, {"status": "affected", "version": "S4FND 105"}, {"status": "affected", "version": "S4FND 106"}, {"status": "affected", "version": "S4FND 107"}, {"status": "affected", "version": "WEBCUIF 701"}, {"status": "affected", "version": "WEBCUIF 731"}, {"status": "affected", "version": "WEBCUIF 746"}, {"status": "affected", "version": "WEBCUIF 747"}, {"status": "affected", "version": "WEBCUIF 748"}, {"status": "affected", "version": "WEBCUIF 800"}, {"status": "affected", "version": "WEBCUIF 801"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>SAP CRM WebClient UI - versions SAPSCORE 129, S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker with user level access can read and modify some sensitive information but cannot delete the data.</p>"}], "value": "SAP CRM WebClient UI - versions SAPSCORE 129, S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker with user level access can read and modify some sensitive information but cannot delete the data.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "eng", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2023-05-09T00:57:57.055Z"}, "references": [{"url": "https://i7p.wdf.sap.corp/sap/support/notes/3315979"}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}], "source": {"discovery": "UNKNOWN"}, "title": "Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.01:*:*:*:*:*:*:*", "matchCriteriaId": "314EA6B5-D3E3-4559-A34A-51A6BB4F3E12", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.31:*:*:*:*:*:*:*", "matchCriteriaId": "470B27E7-C245-43B3-9ED0-545A06158114", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.46:*:*:*:*:*:*:*", "matchCriteriaId": "3DA5DC54-236B-4832-AA79-6EC111EFFBF7", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.47:*:*:*:*:*:*:*", "matchCriteriaId": "4056C921-05B8-4465-96CD-429B520AA6B8", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.48:*:*:*:*:*:*:*", "matchCriteriaId": "A6CBB62D-FDA3-4A23-9175-B9171EA9CE7D", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:8.00:*:*:*:*:*:*:*", "matchCriteriaId": "1440F085-EB15-4910-8AB8-C72E67B8B39E", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:8.01:*:*:*:*:*:*:*", "matchCriteriaId": "F8D60B19-8578-40AF-9A09-5D6EB8D2DB40", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s4fnd:1.02:*:*:*:*:*:*:*", "matchCriteriaId": "3A88FFDD-4967-4E81-8E44-3F4A7BCCE943", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s4fnd:102:*:*:*:*:*:*:*", "matchCriteriaId": "FEA8EA38-C0D1-4EB0-93D5-DEBA8446E685", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s4fnd:103:*:*:*:*:*:*:*", "matchCriteriaId": "43ED5850-580C-40F2-ABCD-CCA33B63D4CF", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s4fnd:104:*:*:*:*:*:*:*", "matchCriteriaId": "104C4099-341D-4796-8425-D61A44FB7839", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s4fnd:105:*:*:*:*:*:*:*", "matchCriteriaId": "66A663D3-247D-497E-8CE3-4D21E4A43C99", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s4fnd:106:*:*:*:*:*:*:*", "matchCriteriaId": "09C81075-4864-47A7-9851-DD46EE9B2E78", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s4fnd:107:*:*:*:*:*:*:*", "matchCriteriaId": "54AD7034-006C-4698-BF4F-D3584D88EC77", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:sapscore:129:*:*:*:*:*:*:*", "matchCriteriaId": "4ACAA9A2-5CD6-4C6B-829B-CB534FADFAD2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "SAP CRM WebClient UI - versions SAPSCORE 129, S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker with user level access can read and modify some sensitive information but cannot delete the data.\n\n"}], "id": "CVE-2023-29188", "lastModified": "2023-05-12T20:38:28.087", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "cna@sap.com", "type": "Secondary"}]}, "published": "2023-05-09T01:15:08.943", "references": [{"source": "cna@sap.com", "tags": ["Broken Link"], "url": "https://i7p.wdf.sap.corp/sap/support/notes/3315979"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cna@sap.com", "type": "Primary"}]}