CVE-2023-27499: Cross-Site Scripting (XSS) vulnerability in SAP GUI for HTML

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-04-11 · updated 2026-06-17
Weakness: CWE-79

Description

SAP GUI for HTML - versions KERNEL 7.22, 7.53, 7.54, 7.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT does not sufficiently encode user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could craft a malicious URL and lure the victim to click, the script supplied by the attacker will execute in the victim user's browser. The information from the victim's web browser can either be modified or read and sent to the attacker.

Affected products

SAP_SE SAP NetWeaver: 7.22ext
SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform: 7.22, 7.53, 7.54, 7.77, 7.81, 7.85 (+4)

References

Get alerted when CVE-2023-27499 or the next vulnerability affects your stack