CVE-2023-37488 MEDIUM

CVE-2023-37488: Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Process Integration

Vendor Sap_Se
Product SAP NetWeaver Process Integration
Weakness CWE-79 · XSS
Published August 8, 2023
Last update October 10, 2024

CVSS base score

6.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

In SAP NetWeaver Process Integration - versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, user-controlled inputs, if not sufficiently encoded, could result in Cross-Site Scripting (XSS) attack. On successful exploitation the attacker can cause limited impact on confidentiality and integrity of the system.

Key dates

02Disclosure timeline

August 8, 2023 CVE published
October 10, 2024 Record updated