CVE-2023-30743
Last modified
CVE-2023-30743 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Due to improper neutralization of input in SAPUI5 - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, sap.m.FormattedText SAPUI5 control allows injection of untrusted CSS. This blocks user’s interaction with the application. EPSS estimates a 0.44% chance of exploitation in the next 30 days.
Description
Due to improper neutralization of input in SAPUI5 - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, sap.m.FormattedText SAPUI5 control allows injection of untrusted CSS. This blocks user’s interaction with the application. Further, in the absence of URL validation by the application, the vulnerability could lead to the attacker reading or modifying user’s information through phishing attack.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sap | Sapui5 | 700 |
| Sap | Sapui5 | 750 |
| Sap | Sapui5 | 754 |
| Sap | Sapui5 | 755 |
| Sap | Sapui5 | 756 |
| Sap | Sapui5 | 757 |
References
- https://launchpad.support.sap.com/#/notes/3326210Permissions Required, Vendor Advisory
- https://launchpad.support.sap.com/#/notes/3326210Permissions Required, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-30743?
How severe is CVE-2023-30743?
How do I fix CVE-2023-30743?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-30738An improper input validation in UEFI Firmware prior to Firmw…7.8
- CVE-2023-30739Arbitrary File Descriptor Write vulnerability in libsec-ril …7.8
- CVE-2023-3074Cross-site Scripting (XSS) - Stored in GitHub repository tso…5.4
- CVE-2023-30740SAP BusinessObjects Business Intelligence Platform - version…7.6
- CVE-2023-30741Due to insufficient input validation, SAP BusinessObjects Bu…6.1
- CVE-2023-30742SAP CRM (WebClient UI) - versions S4FND 102, S4FND 103, S4FN…6.1
- CVE-2023-30744In SAP AS NetWeaver JAVA - versions SERVERCORE 7.50, J2EE-FR…9.1
- CVE-2023-30745Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
- CVE-2023-30746Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
- CVE-2023-30747Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
- CVE-2023-30748Improper Neutralization of Input During Web Page Generation …6.1
- CVE-2023-30749Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
Are you affected by CVE-2023-30743?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST