CVE-2023-24522: sap netweaver_application_server_abap Cross-site Scripting
Vulnerability summary
CVE-2023-24522 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in sap netweaver_application_server_abap. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.6% of scored vulnerabilities.
Timeline
- 14-02-2023PublishedVulnerability first disclosed.
- 20-03-2025Last modifiedVulnerability information updated.
Description
Due to insufficient input sanitization, SAP NetWeaver AS ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, allows an unauthenticated user to alter the current session of the user by injecting the malicious code over the network and gain access to the unintended data. This may lead to a limited impact on the confidentiality and the integrity of the application.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.39%
Chance of exploitation in the next 30 days
Percentile
32%
Versus all other CVEs
30-day change
0.00 pp
From 0.39% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Sap2 products
- netweaver_application_server_abap700 | 701 | 702 | 731 | 740
- netweaver as abap (bsp framework)700 | 701 | 702 | 731 | 740
1 vendor · 2 products