CVE-2023-40624

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

SAP NetWeaver AS ABAP (applications based on Unified Rendering) - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702, SAP_BASIS 731, allows an attacker to inject JavaScript code that can be executed in the web-application. An attacker could thereby control the behavior of this web-application.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SAP_SE	SAP NetWeaver AS ABAP (applications based on Unified Rendering)	SAP_UI 754; SAP_UI 755; SAP_UI 756; SAP_UI 757; SAP_UI 758; SAP_BASIS 702; SAP_BASIS 731

References

https://me.sap.com/notes/3323163Permissions Required, Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
https://me.sap.com/notes/3323163Permissions Required, Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Timeline

Published: Sep 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-406255.4S4CORE (Manage Purchase Contracts App) - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authe CVE-2023-406267.5The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible informa CVE-2023-406276.1A reflected XSS vulnerability was discovered in the LivingWord component for Joomla.CVE-2023-406286.1A reflected XSS vulnerability was discovered in the Extplorer component for Joomla.CVE-2023-406299.8SQLi vulnerability in LMS Lite component for Joomla.CVE-2023-40635.3Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when using an improper eSCL URL GET request.CVE-2023-406309.8Unauthenticated LFI/SSRF in JCDashboards component for Joomla.CVE-2023-406314.4In Dialer, there is a possible missing permission check. This could lead to local information disclosure with System execution privileges ne CVE-2023-406327.5In jpg driver, there is a possible use after free due to a logic error. This could lead to remote information disclosure no additional execu CVE-2023-406335.5In phasecheckserver, there is a possible missing permission check. This could lead to local information disclosure with no additional execut CVE-2023-406347.8In phasechecksercer, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execu CVE-2023-406357.8In linkturbo, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution pr