VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Feb 14, 2023· Updated Jun 17, 2026

CVE-2023-24525

CVE-2023-24525

Description

SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. On successful exploitation an authenticated attacker can cause limited impact on confidentiality of the application.

Affected products

16
  • SAP/Customer Relationship Management Webclient UI10 versions
    cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.00:*:*:*:*:*:*:*+ 9 more
    • cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.00:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.01:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.02:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.31:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.40:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.48:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.50:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:customer_relationship_management_webclient_ui:7.52:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:customer_relationship_management_webclient_ui:8.00:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:customer_relationship_management_webclient_ui:8.01:*:*:*:*:*:*:*
  • SAP/S4FND3 versions
    cpe:2.3:a:sap:s4fnd:1.02:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:sap:s4fnd:1.02:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:s4fnd:1.03:*:*:*:*:*:*:*
    • (no CPE)range: 102, 103
  • SAP/WEBCUIFllm-fuzzy
    Range: 748, 800, 801
  • SAP/CRM WebClient UIllm-fuzzy2 versions
    WEBCUIF 748, 800, 801, S4FND 102, 103+ 1 more
    • (no CPE)range: WEBCUIF 748, 800, 801, S4FND 102, 103
    • (no CPE)range: WEBCUIF 748

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.