CVE-2023-29188— Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI
Quick assessment
Affected
SAP_SE SAP CRM WebClient UI
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP CRM是德国思爱普（SAP）公司的一个客户关系管理系统。 SAP CRM WebClient UI存在跨站脚本漏洞，该漏洞源于没有对用户控制的输入进行充分编码。攻击者利用该漏洞可以读取和修改一些敏感信息，但无法删除数据。以下版本受到影响：SAPSCORE 129、S4FND 102、S4FND 103、S4FND 104、S4FND 105、S4FND 106、S4FND 107、WEBCUIF 701、WEBCUIF 731、WEBCUIF 746、WEBCUIF 747、WEBCUIF 748
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-29188
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI
Source: CVE Program / CVE List V5
Vulnerability Description
SAP CRM WebClient UI - versions SAPSCORE 129, S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker with user level access can read and modify some sensitive information but cannot delete the data.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
SAP CRM 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP CRM是德国思爱普（SAP）公司的一个客户关系管理系统。 SAP CRM WebClient UI存在跨站脚本漏洞，该漏洞源于没有对用户控制的输入进行充分编码。攻击者利用该漏洞可以读取和修改一些敏感信息，但无法删除数据。以下版本受到影响：SAPSCORE 129、S4FND 102、S4FND 103、S4FND 104、S4FND 105、S4FND 106、S4FND 107、WEBCUIF 701、WEBCUIF 731、WEBCUIF 746、WEBCUIF 747、WEBCUIF 748
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP CRM WebClient UI | SAPSCORE 129 | - |
|
II. Public POCs for CVE-2023-29188
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-29188
请登录查看更多情报信息。
Other References for CVE-2023-29188 (2)
Same Patch Batch · SAP_SE · 2023-05-09 · 14 CVEs total
| CVE-2023-28762 | 9.1 CRITICAL | Information Disclosure in SAP BusinessObjects Intelligence Platform |
| CVE-2023-30744 | 8.2 HIGH | Improper access control during application start-up in SAP AS NetWeaver JAVA. |
| CVE-2023-32113 | 7.5 HIGH | Information Disclosure vulnerability in SAP GUI for Windows |
| CVE-2023-32111 | 7.5 HIGH | Memory Corruption vulnerability in SAP PowerDesigner (Proxy) |
| CVE-2023-30743 | 7.1 HIGH | Improper Neutralization of Input in SAPUI5 |
| CVE-2023-30740 | 6.3 MEDIUM | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform |
| CVE-2023-31406 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Plat |
| CVE-2023-30742 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI) |
| CVE-2023-30741 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Plat |
| CVE-2023-31407 | 5.4 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP Business Planning and Consolidation |
| CVE-2023-31404 | 5.0 MEDIUM | Information Disclosure in SAP BusinessObjects Business Intelligence Platform (Central Mana |
| CVE-2023-28764 | 3.7 LOW | Information Disclosure vulnerability in SAP BusinessObjects Platform |
| CVE-2023-32112 | 2.8 LOW | Missing Authorization Check in Vendor Master Hierarchy |
IV. Related Vulnerabilities
Same product: SAP CRM WebClient UI
-
CVE-2024-37175
[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClie -
CVE-2024-39598
[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClie -
CVE-2024-37174
[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClie -
CVE-2024-37173
[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClie -
CVE-2024-34686
Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClie
Same vendor: SAP_SE
-
CVE-2026-76974
Information Disclosure vulnerability in SAP Fiori Launchpad -
CVE-2026-76977
Clickjacking vulnerability in SAPUI5(Frame Options Allowlist -
CVE-2026-76971
Server-Side Request Forgery in SAP Manufacturing Integration -
CVE-2026-76969
Credential disclosure in multitenant applications using SAP -
CVE-2026-76968
Information Disclosure vulnerability in SAP Web Dispatcher,
Same weakness: CWE-79
-
CVE-2026-85679
Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scrip -
CVE-2026-67075
HCL Digital Experience is affected by improper input sanitat -
CVE-2026-12241
Advanced Woo Labels – Product Labels & Badges for WooCommerc -
CVE-2026-96561
AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scrip -
CVE-2026-103590
QloApps through 1.7.0 Reflected XSS via Length of Stay Field
V. Comments for CVE-2023-29188
No comments yet