CVE-2023-26457

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

SAP Content Server - version 7.53, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can read and modify some sensitive information but cannot delete the data.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SAP	Content Server	7.53

References

https://launchpad.support.sap.com/#/notes/3281484Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
https://launchpad.support.sap.com/#/notes/3281484Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Timeline

Published: Mar 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-264588.7An information disclosure vulnerability exists in SAP Landscape Management - version 3.0, enterprise edition. It allows an authenticated SAP CVE-2023-264597.4Due to improper input controls In SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 7 CVE-2023-26464.5A vulnerability has been found in TP-Link Archer C7v2 v2_en_us_180114 and classified as problematic. Affected by this vulnerability is an un CVE-2023-264605.3Cache Management Service in SAP NetWeaver Application Server for Java - version 7.50, does not perform any authentication checks for functio CVE-2023-264614.9SAP NetWeaver allows (SAP Enterprise Portal) - version 7.50, allows an authenticated attacker with sufficient privileges to access the XML p CVE-2023-264628.1ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usable for privilege esc CVE-2023-264639.8strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes wit CVE-2023-264647.5** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that CVE-2023-264656.1Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.CVE-2023-264667.8A user with non-Admin access can change a configuration file on the client to modify the Server URL.CVE-2023-264675.4A man in the middle can redirect traffic to a malicious server in a compromised configuration.CVE-2023-264689.1Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.