Lucene search
HistoryDec 12, 2023 - 1:15 a.m.
CVE-2023-42479
unauthenticated access
biller direct
xss attack
disclosure
modification
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
20.5%
An unauthenticated attacker can embed a hidden access to a Biller Direct URL in a frame which, when loaded by the user, will submit a cross-site scripting request to the Biller Direct system. This can result in the disclosure or modification of non-sensitive information.
Affected configurations
Node
sapbiller_directMatch635
ORsapbiller_directMatch750
| Vendor | Product | Version | CPE |
|---|---|---|---|
| sap | biller_direct | 635 | cpe:2.3:a:sap:biller_direct:635:*:*:*:*:*:*:* |
| sap | biller_direct | 750 | cpe:2.3:a:sap:biller_direct:750:*:*:*:*:*:*:* |
Related
cve
cve
CVE-2023-42479
2023-12-12 01:15:10
cnvd
cnvd
SAP Biller Direct Cross-Site Scripting Vulnerability
2023-12-14 00:00:00
prion
prion
Cross site scripting
2023-12-12 01:15:00
cvelist
cvelist
CVE-2023-42479 Cross-Site Scripting (XSS) vulnerability in SAP Biller Direct
2023-12-12 00:59:36
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
20.5%
Related for NVD:CVE-2023-42479