title: Cross-Site Scripting (XSS) vulnerability in SAP GUI for HTML
description: SAP GUI for HTML - versions KERNEL 7.22, 7.53, 7.54, 7.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT does not sufficiently encode user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could craft a malicious URL and lure the victim to click, the script supplied by the attacker will execute in the victim user's browser. The information from the victim's web browser can either be modified or read and sent to the attacker.
problem types: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
affected:
{
defaultStatus: unaffected
product: GUI for HTML
vendor: SAP_SE
versions:
status: affected, version: KERNEL 7.22
status: affected, version: KERNEL 7.53
status: affected, version: KERNEL 7.54
status: affected, version: KERNEL 7.77
status: affected, version: KERNEL 7.81
status: affected, version: KERNEL 7.85
status: affected, version: KERNEL 7.89
status: affected, version: KERNEL 7.91
status: affected, version: KRNL64UC 7.22
status: affected, version: KRNL64UC 7.22EXT
status: affected, version: KRNL64UC 7.53
status: affected, version: KRNL64NUC 7.22
status: affected, version: KRNL64NUC 7.22EXT
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL