description: SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to the DOM that could steal user information. Software components affected are: SAP Hana Database 1.00, 2.00; SAP UI5 1.00; SAP UI5 (Java) 7.30, 7.31, 7.40, 7,50; SAP UI 7.40, 7.50, 7.51, 7.52, and version 2.0 of SAP UI for SAP NetWeaver 7.00
problem types: Cross-Site Scripting
affected:
{
product: SAP HANA Database
vendor: SAP SE
versions:
status: affected, version: 1.0
status: affected, version: 2.0
}
{
product: SAP UI5
vendor: SAP SE
versions:
status: affected, version: 1.0
}
{
product: SAP UI5(Java)
vendor: SAP SE
versions:
status: affected, version: 7.3
status: affected, version: 7.31
status: affected, version: 7.40
status: affected, version: 7.50
}
{
product: SAP UI
vendor: SAP SE
versions:
status: affected, version: 7.40
status: affected, version: 7.50
status: affected, version: 7.51
status: affected, version: 7.52
}
{
product: SAP UI for SAP NetWeaver 7.00
vendor: SAP SE
versions:
status: affected, version: 2.0
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.0
]