| Title | 複数の SAP 製品におけるクロスサイトスクリプティングの脆弱性 |
|---|---|
| Summary | ABAP platform、application interface framework、SAP Basis 等複数の SAP 製品には、クロスサイトスクリプティングの脆弱性が存在します。 |
| Possible impacts | 情報を取得される、および情報を改ざんされる可能性があります。 |
| Solution | ベンダアドバイザリまたはパッチ情報が公開されています。参考情報を参照して適切な対策を実施してください。 |
| Publication Date | April 11, 2023, midnight |
| Registration Date | Nov. 17, 2023, 2:33 p.m. |
| Last Update | Nov. 17, 2023, 2:33 p.m. |
| CVSS3.0 : 警告 | |
| Score | 5.4 |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| SAP |
| ABAP platform 75c |
| ABAP platform 75d |
| ABAP platform 75e |
| application interface framework aif 703 |
| application interface framework aifx 702 |
| S4CORE 100 |
| S4CORE 101 |
| SAP Basis 755 |
| SAP Basis 756 |
| No | Changed Details | Date of change |
|---|---|---|
| 1 | [2023年11月17日] 掲載 |
Nov. 17, 2023, 2:33 p.m. |
| Summary | The SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows the usage HTML tags. An authorized attacker can use some of the basic HTML codes such as heading, basic formatting and lists, then an attacker can inject images from the foreign domains. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application. |
|---|---|
| Publication Date | April 11, 2023, 1:16 p.m. |
| Registration Date | April 11, 2023, 4 p.m. |
| Last Update | Nov. 21, 2024, 4:56 p.m. |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:sap:abap_platform:75c:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:sap:abap_platform:75d:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:sap:abap_platform:75e:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:sap:basis:755:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:sap:basis:756:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:sap:s4core:101:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:sap:application_interface_framework:aifx_702:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:sap:application_interface_framework:aif_703:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:sap:s4core:100:*:*:*:*:*:*:* | |||||