CVE-2023-42479

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An unauthenticated attacker can embed a hidden access to a Biller Direct URL in a frame which, when loaded by the user, will submit a cross-site scripting request to the Biller Direct system. This can result in the disclosure or modification of non-sensitive information.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SAP_SE	SAP Biller Direct	635; 750

References

https://me.sap.com/notes/3383321Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
https://me.sap.com/notes/3383321Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Timeline

Published: Dec 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-42484.3The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing CVE-2023-424805.3The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the CVE-2023-424818.1In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misus CVE-2023-424827.5Samsung Mobile Processor Exynos 2200 allows a GPU Use After Free.CVE-2023-424834.7A TOCTOU race condition in Samsung Mobile Processor Exynos 9820, Exynos 980, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, and Exynos CVE-2023-424867.8Fortect - CWE-428: Unquoted Search Path or Element, may be used by local user to elevate privileges.CVE-2023-424877.5Soundminer – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-424887.5EisBaer Scada - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-424899.8EisBaer Scada - CWE-732: Incorrect Permission Assignment for Critical Resource CVE-2023-42499.8Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.0 CVE-2023-424907.5EisBaer Scada - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVE-2023-424919.8EisBaer Scada - CWE-285: Improper Authorization