LiveActive security incident?Get immediate response
CVE Record

CVE-2023-24525: SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-co...

SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. On successful exploitation an authenticated attacker can cause limited impact on confidentiality of the application.

MediumCVSS 4.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-24525 is a medium-severity XSS issue in SAP CRM WebClient UI. Some user-controlled input is not encoded sufficiently, allowing an authenticated attacker to cause limited confidentiality impact. The provided sources do not show active exploitation or describe a standalone workaround.

Executive priority

Treat this as a normal SAP security maintenance item, not an emergency based on the provided evidence. Prioritize affected systems with broad user access, external reachability, or sensitive CRM data.

Technical view

The issue is CWE-79 cross-site scripting in SAP CRM WebClient UI components WEBCUIF 748, 800, 801 and S4FND 102, 103. CVSS 3.1 is 4.3: network exploitable, low complexity, low privileges, no user interaction, unchanged scope, low confidentiality impact, no integrity or availability impact.

Likely exposure

Exposure is most likely where SAP CRM WebClient UI is deployed with affected WEBCUIF or S4FND component versions and reachable by authenticated users. Systems not running the affected components or versions are outside the stated affected set.

Exploitation context

The source bundle marks KEV as false and provides no cited evidence of active exploitation. The CVSS vector indicates an authenticated network attacker with low privileges could exploit the flaw without user interaction, with impact limited to confidentiality.

Researcher notes

Evidence is limited to the CVE description, CVSS vector, affected component list, SAP note reference, and SAP security reference page. No exploit details, proof-of-concept status, or explicit workaround is included in the bundle.

Mitigation direction

  • Check SAP Note 2788178 for vendor remediation guidance.
  • Apply SAP-supported fixes or corrections if the note marks the system applicable.
  • Limit SAP CRM WebClient UI access to required authenticated users.
  • Prioritize remediation on internet-facing or broadly accessible SAP environments.

Validation and detection

  • Inventory SAP systems for WEBCUIF 748, 800, 801 and S4FND 102, 103.
  • Confirm whether SAP Note 2788178 applies to each system.
  • Review WebClient UI exposure paths and authenticated user populations.
  • Verify remediation status through SAP support tooling or patch records.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-79: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2023-24525 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4.3CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N2.81.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

4.3Medium
CVSS 3.1 vector shape for CVE-2023-24525Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
SAPCRM (WebClient UI)WEBCUIF 748, 800, 801, S4FND 102, 103unaffected
Weakness

CWE details

CWE-79

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.