Sap Netweaver Application Server Abap Applications Based On Sap Gui For Html
Monthly
Cross-site scripting in applications based on SAP GUI for HTML on SAP NetWeaver Application Server ABAP lets an authenticated attacker (PR:L) inject malicious content through functionality that does not sufficiently sanitize user-supplied input, with the script executing in a second user's browser once that victim interacts with the poisoned content (UI:R). The flaw is rated CVSS 5.4 (CWE-79), with scope change and low confidentiality/integrity impact and no availability impact; SAP is the reporting vendor and has published Security Note 3671819. There is no public exploit identified at time of analysis and no CISA KEV listing, so this should be treated as a medium-severity, credentialed-to-credentialed escalation path rather than an internet-facing emergency.
Cross-site scripting in applications based on SAP GUI for HTML on SAP NetWeaver Application Server ABAP lets an authenticated attacker (PR:L) inject malicious content through functionality that does not sufficiently sanitize user-supplied input, with the script executing in a second user's browser once that victim interacts with the poisoned content (UI:R). The flaw is rated CVSS 5.4 (CWE-79), with scope change and low confidentiality/integrity impact and no availability impact; SAP is the reporting vendor and has published Security Note 3671819. There is no public exploit identified at time of analysis and no CISA KEV listing, so this should be treated as a medium-severity, credentialed-to-credentialed escalation path rather than an internet-facing emergency.