Lucene search

China National Vulnerability DatabaseCNVD-2023-100006

HistoryDec 14, 2023 - 12:00 a.m.

SAP Biller Direct Cross-Site Scripting Vulnerability

2023-12-1400:00:00

China National Vulnerability Database

www.cnvd.org.cn

sap

biller direct

cross-site scripting

vulnerability

web application

germany

filtering

escaping

user-supplied data

exploitation

attacker

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.7%

JSON

SAP Biller Direct is a Web application from SAP Germany. It is used to present customer accounts in an Internet portal. A cross-site scripting vulnerability exists in SAP Biller Direct versions 635 and 750, which stems from the application’s lack of effective filtering and escaping of user-supplied data, and can be exploited by an attacker to execute arbitrary Web script or HTML by injecting a crafted payload.