Vendor Invoice Management For Sap Solutions
Monthly
Stored cross-site scripting in the Capture Validation application of OpenText Vendor Invoice Management for SAP Solutions allows a high-privileged authenticated user to persist malicious script content that later executes in another user's browser when the affected view is opened, potentially exposing or altering invoice data processed by the application. The vendor rates the issue 7.3, while our independent assessment places it at moderate severity (CVSS 3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) because exploitation requires privileged access to plant the payload, victim interaction to trigger it, and an additional unspecified application condition per the vendor's 'under certain conditions' qualifier. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV.
Stored cross-site scripting in the Capture Validation application of OpenText Vendor Invoice Management for SAP Solutions allows a high-privileged authenticated user to persist malicious script content that later executes in another user's browser when the affected view is opened, potentially exposing or altering invoice data processed by the application. The vendor rates the issue 7.3, while our independent assessment places it at moderate severity (CVSS 3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) because exploitation requires privileged access to plant the payload, victim interaction to trigger it, and an additional unspecified application condition per the vendor's 'under certain conditions' qualifier. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV.