Cross-site scripting in SAP E-Commerce
Priority LOW 30CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP-CRMAPP SAP-SHRAPP, versions 7.30, 7.31, 7.32, 7.33, 7.54.
Why it matters now
EPSS 0.01325 71st percentileScored 2026-11-07
Fix Fixed SAP E-Commerce (SAP-CRMJAV, SAP-CRMWEB, SAP-SHRWEB, SAP-SHRJAV, SAP-CRMAPP, SAP-SHRAPP) (SAP SE): 7.3, 7.31, 7.32 +2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP E-Commerce (SAP-CRMJAV, SAP-CRMWEB, SAP-SHRWEB, SAP-SHRJAV, SAP-CRMAPP, SAP-SHRAPP) | before 7.3; before 7.31; before 7.32; before 7.33; before 7.54 | 7.3, 7.31, 7.32, 7.33, 7.54 | Patch available | CNA |
- SAP E-Commerce (SAP-CRMJAV, SAP-CRMWEB, SAP-SHRWEB, SAP-SHRJAV, SAP-CRMAPP, SAP-SHRAPP) VendorSAP Affected before 7.3; before 7.31; before 7.32; before 7.33; before 7.54 Fixed in 7.3, 7.31, 7.32, 7.33, 7.54 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:e-commerce:7.30:*:*:*:*:*:*:* | 7.30 | Vulnerable | SAP |
| cpe:2.3:a:sap:e-commerce:7.31:*:*:*:*:*:*:* | 7.31 | Vulnerable | SAP |
| cpe:2.3:a:sap:e-commerce:7.32:*:*:*:*:*:*:* | 7.32 | Vulnerable | SAP |
| cpe:2.3:a:sap:e-commerce:7.33:*:*:*:*:*:*:* | 7.33 | Vulnerable | SAP |
| cpe:2.3:a:sap:e-commerce:7.54:*:*:*:*:*:*:* | 7.54 | Vulnerable | SAP |
- cpe:2.3:a:sap:e-commerce:7.30:*:*:*:*:*:*:* Versions 7.30 Vulnerable ·SAP
- cpe:2.3:a:sap:e-commerce:7.31:*:*:*:*:*:*:* Versions 7.31 Vulnerable ·SAP
- cpe:2.3:a:sap:e-commerce:7.32:*:*:*:*:*:*:* Versions 7.32 Vulnerable ·SAP
- cpe:2.3:a:sap:e-commerce:7.33:*:*:*:*:*:*:* Versions 7.33 Vulnerable ·SAP
- cpe:2.3:a:sap:e-commerce:7.54:*:*:*:*:*:*:* Versions 7.54 Vulnerable ·SAP
Remediation
- Fix · CNA SAP E-Commerce (SAP-CRMJAV, SAP-CRMWEB, SAP-SHRWEB, SAP-SHRJAV, SAP-CRMAPP, SAP-SHRAPP) (SAP SE) Fixed in 7.3, 7.31, 7.32, 7.33, 7.54
Timeline
- 2026-10-02 Threatist record created from CVE-2019-0298
- 2026-10-03 Alias added: GHSA-qp4x-8h8x-vr88
References
More SAP E-commerce vulnerabilities
- TI-2019-00258 Cross-site scripting in SAP E-Commerce CVSS 3.0MEDIUM 6.8
Sources
- CVE-2019-0298 · CVE Program
- CVE-2019-0298 · NVD
- FIRST EPSS
- GHSA-qp4x-8h8x-vr88 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences