CVE-2023-33985
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
SAP NetWeaver Enterprise Portal version 7.50 does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability. Successful exploitation allows an attacker to view or modify information, causing limited impact on confidentiality and integrity of the application.
Risk Assessment
The organization may be exposed to attacks that could lead to data disclosure or modification, impacting the application's security. Although the impact is limited, the risk of data breaches remains significant.
Recommendation
It is recommended to update SAP NetWeaver Enterprise Portal to the latest version to patch this vulnerability and implement additional security measures against XSS.
Original NVD description (English source)
SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.