SAP Manufacturing Integration XSS and Authorization Flaws

SAP MII's administrative account-provisioning function fails to enforce proper authorization boundaries, enabling an attacker who already holds MII administrator privileges to craft a request that provisions an account with elevated privileges on the underlying Java application server. This can extend compromise beyond MII to the host, with high confidentiality, integrity, and availability impact, and is reflected in a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). No public exploit code or confirmed active exploitation was identified at time of analysis.

Stored cross-site scripting in SAP Manufacturing Integration and Intelligence (MII) lets an authenticated, low-privileged attacker persist malicious content that is later rendered and executed in the browser of an authenticated victim who opens the affected page. Scored CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), the flaw requires a valid low-privileged MII account to plant the payload plus victim navigation to the tainted page, so exploitation is limited to the victim's browser context: session information access, modified page content, and local disruption of the application, not server compromise. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.