Riskcovery

CVE-2023-30743

Improper Neutralization of Input in SAPUI5

State
Published
Severity
7.1 High
Published
May 9, 2023
Updated
Jan 28, 2025
Reserved
Apr 14, 2023

Read the record on cve.org

Description

Due to improper neutralization of input in SAPUI5 - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, sap.m.FormattedText SAPUI5 control allows injection of untrusted CSS. This blocks user’s interaction with the application. Further, in the absence of URL validation by the application, the vulnerability could lead to the attacker reading or modifying user’s information through phishing attack.

Scores

CVSSScoreVectorSource
3.17.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Lsap

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

ProductVersions
SAPUI5SAP_SE
  • SAP_UI 750Affected
  • SAP_UI 754Affected
  • SAP_UI 755Affected
  • SAP_UI 756Affected
  • SAP_UI 757Affected
  • UI_700 200Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.