Sapui5 Support Assistant Overlay
Monthly
DOM-based cross-site scripting in the SAPUI5 Support Assistant Overlay lets an unauthenticated attacker craft a publicly hosted link that, when opened by a logged-in SAP user, causes attacker-controlled input to be read by client-side code and written into the DOM without sanitization, executing script in that user's browser context. Exploitation is not automatic: it requires the Overlay component to be present and reachable plus user interaction (UI:R), so the attacker must socially engineer a specific authenticated victim into clicking the link. There is no public exploit identified at time of analysis and no confirmed active exploitation; the assessed severity is moderate (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) with limited confidentiality and integrity impact on the victim's browser scope and no availability impact.
DOM-based cross-site scripting in the SAPUI5 Support Assistant Overlay lets an unauthenticated attacker craft a publicly hosted link that, when opened by a logged-in SAP user, causes attacker-controlled input to be read by client-side code and written into the DOM without sanitization, executing script in that user's browser context. Exploitation is not automatic: it requires the Overlay component to be present and reachable plus user interaction (UI:R), so the attacker must socially engineer a specific authenticated victim into clicking the link. There is no public exploit identified at time of analysis and no confirmed active exploitation; the assessed severity is moderate (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) with limited confidentiality and integrity impact on the victim's browser scope and no availability impact.