Vulnerability · Published Apr 11, 2023 · Assigned by sap

CVE-2023-29112Code Injection vulnerability in SAP Application Interface Framework (Message Monitoring)

Low 3.7

In plain English

A low-severity security flaw in Application Interface Framework (Message Monitoring) from SAP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.3%top 74.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The SAP Application Interface (Message Monitoring) - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a comment. The comment will render links and custom CSS classes as HTML objects. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application.

Affected products (as reported)

Vendor	Product	Versions
SAP	Application Interface Framework (Message Monitoring)	600700

Weakness: CWE-80 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

In plain English

Official description

Affected products (as reported)

References