CVE-2023-37488
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
In SAP NetWeaver Process Integration versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, insufficiently encoded user-controlled inputs may lead to a Cross-Site Scripting (XSS) attack. Successful exploitation could impact the confidentiality and integrity of the system.
Risk Assessment
XSS attacks can lead to the disclosure of sensitive information and data integrity breaches, posing a risk to the organization's security.
Recommendation
It is recommended to properly encode user-controlled inputs and regularly update the system to the latest versions to minimize the risk of XSS attacks.
Original NVD description (English source)
In SAP NetWeaver Process Integration - versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, user-controlled inputs, if not sufficiently encoded, could result in Cross-Site Scripting (XSS) attack. On successful exploitation the attacker can cause limited impact on confidentiality and integrity of the system.