CVE-2023-33986

MediumCVSS 6.1

Published: 13/06/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

33th percentile - higher than 33% of all known CVEs

Summary

SAP CRM ABAP in versions 700, 701, 702, 712, 713, 714 does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact on the confidentiality and integrity of the application.

Risk Assessment

The organization may be exposed to attacks that could affect the confidentiality and integrity of data within the application. Potential exploitation of this vulnerability could lead to unauthorized access to information.

Recommendation

It is recommended to update to the latest version of SAP CRM ABAP that includes security patches. Additionally, implementing input filtering and validation mechanisms is advisable.

Original NVD description (English source)

SAP CRM ABAP (Grantor Management) - versions 700, 701, 702, 712, 713, 714, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.