CVE-2023-33991
Last modified
CVE-2023-33991 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. SAP UI5 Variant Management - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, does not sufficiently encode user-controlled inputs on reading data from the server, resulting in Stored Cross-Site Scripting (Stored XSS) vulnerability. After successful exploitation, an attacker with user level access can cause high impact on confidentiality, modify some information and can cause unavailability of the application at user level. . EPSS estimates a 0.48% chance of exploitation in the next 30 days.
Description
SAP UI5 Variant Management - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, does not sufficiently encode user-controlled inputs on reading data from the server, resulting in Stored Cross-Site Scripting (Stored XSS) vulnerability. After successful exploitation, an attacker with user level access can cause high impact on confidentiality, modify some information and can cause unavailability of the application at user level.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sap | Ui | 700 |
| Sap | Ui | 750 |
| Sap | Ui | 754 |
| Sap | Ui | 755 |
| Sap | Ui | 756 |
| Sap | Ui | 757 |
References
- https://launchpad.support.sap.com/#/notes/3324285Permissions Required
- https://launchpad.support.sap.com/#/notes/3324285Permissions Required
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-33991?
How severe is CVE-2023-33991?
How do I fix CVE-2023-33991?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-33986SAP CRM ABAP (Grantor Management) - versions 700, 701, 702, …6.1
- CVE-2023-33987An unauthenticated attacker in SAP Web Dispatcher - versions…9.4
- CVE-2023-33988In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE…6.1
- CVE-2023-33989An attacker with non-administrative authorizations in SAP Ne…8.1
- CVE-2023-3399An issue has been discovered in GitLab EE affecting all vers…7.7
- CVE-2023-33990SAP SQL Anywhere - version 17.0, allows an attacker to preve…7.1
- CVE-2023-33992The SAP BW BICS communication layer in SAP Business Warehous…6.5
- CVE-2023-33993B1i module of SAP Business One - version 10.0, application a…7.5
- CVE-2023-33994Missing Authorization vulnerability in VeronaLabs Slimstat A…6.5
- CVE-2023-33995Missing Authorization vulnerability in Photo Gallery Team Ph…4.3
- CVE-2023-33996Missing Authorization vulnerability in СleanTalk - Anti-Spam…8.8
- CVE-2023-33997Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
Are you affected by CVE-2023-33991?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST