CVE-2023-31407 MEDIUM

CVE-2023-31407: Cross-Site Scripting (XSS) vulnerability in SAP Business Planning and Consolidation

Vendor Sap_Se
Product SAP Business Planning and Consolidation
Weakness CWE-79 · XSS
Published May 9, 2023
Last update January 28, 2025
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

SAP Business Planning and Consolidation - versions 740, 750, allows an authorized attacker to upload a malicious file, resulting in Cross-Site Scripting vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.

Key dates

02Disclosure timeline

May 9, 2023 CVE published
January 28, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-31893 WordPress Botnet Attack Blocker plugin <= 2.0.0 - Stored Cross Site Scripting (XSS) vulnerability CVE-2020-10509 Sunnet eHRD - Cross-Site Scripting CVE-2022-47431 WordPress Open RDW kenteken voertuiginformatie Plugin <= 2.0.14 is vulnerable to Cross Site Scripting (XSS) CVE-2025-59412 CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement CVE-2025-10180 Markdown Shortcode <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting