CVE-2023-33984
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
SAP NetWeaver (Design Time Repository) version 7.50 returns an unfavorable content type for some versioned files, which could allow an authorized attacker to create a file with malicious content and send a link to a victim in an email or instant message. Under certain circumstances, this could lead to a Cross-Site Scripting vulnerability.
Risk Assessment
The organization may be exposed to Cross-Site Scripting attacks, which could lead to user data theft or session hijacking. Malicious links could be used for phishing or spreading malware.
Recommendation
It is recommended to update SAP NetWeaver to the latest version and to monitor and filter links in emails and instant messages. A security audit of the application should also be conducted.
Original NVD description (English source)
SAP NetWeaver (Design Time Repository) - version 7.50, returns an unfavorable content type for some versioned files, which could allow an authorized attacker to create a file with a malicious content and send a link to a victim in an email or instant message. Under certain circumstances, this could lead to Cross-Site Scripting vulnerability.