CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
Percentile
17.7%
Due to insufficient input validation, SAP
CRM WebClient UI allows an unauthenticated attacker to craft a URL link which
embeds a malicious script. When a victim clicks on this link, the script will
be executed in the victim’s browser giving the attacker the ability to access
and/or modify information with no effect on availability of the application.
Vendor | Product | Version | CPE |
---|---|---|---|
sap | customer_relationship_management_s4fnd | 102 | cpe:2.3:a:sap:customer_relationship_management_s4fnd:102:*:*:*:*:*:*:* |
sap | customer_relationship_management_s4fnd | 103 | cpe:2.3:a:sap:customer_relationship_management_s4fnd:103:*:*:*:*:*:*:* |
sap | customer_relationship_management_s4fnd | 104 | cpe:2.3:a:sap:customer_relationship_management_s4fnd:104:*:*:*:*:*:*:* |
sap | customer_relationship_management_s4fnd | 105 | cpe:2.3:a:sap:customer_relationship_management_s4fnd:105:*:*:*:*:*:*:* |
sap | customer_relationship_management_s4fnd | 106 | cpe:2.3:a:sap:customer_relationship_management_s4fnd:106:*:*:*:*:*:*:* |
sap | customer_relationship_management_s4fnd | 107 | cpe:2.3:a:sap:customer_relationship_management_s4fnd:107:*:*:*:*:*:*:* |
sap | customer_relationship_management_s4fnd | 108 | cpe:2.3:a:sap:customer_relationship_management_s4fnd:108:*:*:*:*:*:*:* |
sap | customer_relationship_management_webclient_ui | 701 | cpe:2.3:a:sap:customer_relationship_management_webclient_ui:701:*:*:*:*:*:*:* |
sap | customer_relationship_management_webclient_ui | 731 | cpe:2.3:a:sap:customer_relationship_management_webclient_ui:731:*:*:*:*:*:*:* |
sap | customer_relationship_management_webclient_ui | 746 | cpe:2.3:a:sap:customer_relationship_management_webclient_ui:746:*:*:*:*:*:*:* |