Read the docs
TI-2023-12227 Aliases CVE-2023-27499GHSA-mqmw-59rf-wv9g

Cross-Site Scripting (XSS) vulnerability in SAP GUI for HTML

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

SAP GUI for HTML - versions KERNEL 7.22, 7.53, 7.54, 7.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT does not sufficiently encode user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could craft a malicious URL and lure the victim to click, the script supplied by the attacker will execute in the victim user's browser. The information from the victim's web browser can either be modified or read and sent to the attacker.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00445 38th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPGUI for HTMLKERNEL 7.22; KERNEL 7.53; KERNEL 7.54; KERNEL 7.77; KERNEL 7.81; KERNEL 7.85; KERNEL 7.89; KERNEL 7.91; KRNL64UC 7.22; KRNL64UC 7.22EXT; KRNL64UC 7.53; KRNL64NUC 7.22; KRNL64NUC 7.22EXT—No fix listedCNA
  • GUI for HTML VendorSAP Affected KERNEL 7.22; KERNEL 7.53; KERNEL 7.54; KERNEL 7.77; KERNEL 7.81; KERNEL 7.85; KERNEL 7.89; KERNEL 7.91; KRNL64UC 7.22; KRNL64UC 7.22EXT; KRNL64UC 7.53; KRNL64NUC 7.22; KRNL64NUC 7.22EXT Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:sap:netweaver:7.22ext:*:*:*:*:*:*:*7.22extVulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:7.22:*:*:*:*:*:*:*7.22VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:7.53:*:*:*:*:*:*:*7.53VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:7.54:*:*:*:*:*:*:*7.54VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:7.77:*:*:*:*:*:*:*7.77VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:7.81:*:*:*:*:*:*:*7.81VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:7.85:*:*:*:*:*:*:*7.85VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:7.89:*:*:*:*:*:*:*7.89VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:7.91:*:*:*:*:*:*:*7.91VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc:*:*:*:*:*:*:*krnl64ucVulnerableSAP
  • cpe:2.3:a:sap:netweaver:7.22ext:*:*:*:*:*:*:* Versions 7.22ext Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.22:*:*:*:*:*:*:* Versions 7.22 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.53:*:*:*:*:*:*:* Versions 7.53 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.54:*:*:*:*:*:*:* Versions 7.54 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.77:*:*:*:*:*:*:* Versions 7.77 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.81:*:*:*:*:*:*:* Versions 7.81 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.85:*:*:*:*:*:*:* Versions 7.85 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.89:*:*:*:*:*:*:* Versions 7.89 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.91:*:*:*:*:*:*:* Versions 7.91 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc:*:*:*:*:*:*:* Versions krnl64uc Vulnerable ·SAP
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.22:*:*:*:*:*:*:*krnl64uc_7.22VulnerableSAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.22:*:*:*:*:*:*:* Versions krnl64uc_7.22 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-27499
  2. 2026-10-03 Alias added: GHSA-mqmw-59rf-wv9g

References

Advisory 1

Other 1

  • TI-2025-22522 Missing Authorization check in SAP NetWeaver (Visual Composer development server) KEVCVSS 3.1CRITICAL 10.0
  • TI-2021-15842 Path traversal in SAP NetWeaver KEVCVSS 3.1CRITICAL 9.9
  • TI-2025-27866 Insecure Deserialization in SAP NetWeaver (Visual Composer development server) KEVCVSS 3.1CRITICAL 9.1
  • TI-2012-02262 The DiagTraceR3Info function in the Dialog processor in disp+work.exe 7010.29.15.58313… CVSS 2.0HIGH 9.3
  • TI-2013-01399 A Buffer Overflow vulnerability exists in the Message Server service… CVSS 3.1CRITICAL 9.8
  • TI-2016-02149 Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing… CVSS 3.0HIGH 7.5
See all 101 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences