CVE-2023-29112CWE-80

Code Injection vulnerability in SAP Application Interface Framework (Message Monitoring)

Low · published April 11, 2023

CVSS v3.1
3.7
EPSS
0%
Percentile
24.2
In the wild
Unconfirmed
What it is

The SAP Application Interface (Message Monitoring) - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a comment. The comment will render links and custom CSS classes as HTML objects. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00324 · 24.2th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2023-04-11T03:03Z
EPSS history
Timeline
  • 11 APR 03:03Z
    Code Injection vulnerability in SAP Application Interface Framework (Message Monitoring)
    cvelistv5