CVE-2023-24525

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. On successful exploitation an authenticated attacker can cause limited impact on confidentiality of the application.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SAP	CRM (WebClient UI)	WEBCUIF 748; 800; 801; S4FND 102; 103

References

https://launchpad.support.sap.com/#/notes/2788178Permissions Required, Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
https://launchpad.support.sap.com/#/notes/2788178Permissions Required, Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Timeline

Published: Feb 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-245265.3SAP NetWeaver Application Server Java for Classload Service - version 7.50, does not perform any authentication checks for functionalities t CVE-2023-245275.3SAP NetWeaver AS Java for Deploy Service - version 7.5, does not perform any access control checks for functionalities that require user ide CVE-2023-245286.5SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600, allows an authenticated attacker to exploit a certain m CVE-2023-245296.1Due to lack of proper input validation, BSP application (CRM_BSP_FRAME) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75 CVE-2023-24538.8There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘requir CVE-2023-245309.1SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code th CVE-2023-245319.8Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executi CVE-2023-245325.3The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a CVE-2023-245337.5Multiplication of certain unreduced P-256 scalars produce incorrect results. There are no protocols known at this time that can be attacked CVE-2023-245347.5HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of servic CVE-2023-245357.5Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more CVE-2023-245367.5Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This