Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2023-30743

Improper Neutralization of Input in SAPUI5

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

Due to improper neutralization of input in SAPUI5 - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, sap.m.FormattedText SAPUI5 control allows injection of untrusted CSS. This blocks user’s interaction with the application. Further, in the absence of URL validation by the application, the vulnerability could lead to the attacker reading or modifying user’s information through phishing attack.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP_SE SAPUI5

Default version status: unaffected

  • SAP_UI 750affected
  • SAP_UI 754affected
  • SAP_UI 755affected
  • SAP_UI 756affected
  • SAP_UI 757affected
  • UI_700 200affected

References