TI-2023-13552 Aliases CVE-2023-29110 GHSA-666p-hwqx-vc2f

Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard)

LOW 24CWE-80Published 2023-04-11 · Updated 2025-02-07

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-80.

Summary

The SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows the usage HTML tags. An authorized attacker can use some of the basic HTML codes such as heading, basic formatting and lists, then an attacker can inject images from the foreign domains. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00324 25th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	Application Interface Framework (Message Dashboard)	AIF 703; AIFX 702; S4CORE 100; S4CORE 101; SAP_BASIS 755; SAP_BASIS 756; SAP_ABA 75C; SAP_ABA 75D; SAP_ABA 75E	—	No fix listed	CNA

Application Interface Framework (Message Dashboard) VendorSAP Affected AIF 703; AIFX 702; S4CORE 100; S4CORE 101; SAP_BASIS 755; SAP_BASIS 756; SAP_ABA 75C; SAP_ABA 75D; SAP_ABA 75E Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:abap_platform:75c:::::::*	75c	Vulnerable	SAP
cpe:2.3:a:sap:abap_platform:75d:::::::*	75d	Vulnerable	SAP
cpe:2.3:a:sap:abap_platform:75e:::::::*	75e	Vulnerable	SAP
cpe:2.3:a:sap:application_interface_framework:aif_703:::::::*	aif_703	Vulnerable	SAP
cpe:2.3:a:sap:application_interface_framework:aifx_702:::::::*	aifx_702	Vulnerable	SAP
cpe:2.3:a:sap:basis:755:::::::*	755	Vulnerable	SAP
cpe:2.3:a:sap:basis:756:::::::*	756	Vulnerable	SAP
cpe:2.3:a:sap:s4core:100:::::::*	100	Vulnerable	SAP
cpe:2.3:a:sap:s4core:101:::::::*	101	Vulnerable	SAP

cpe:2.3:a:sap:abap_platform:75c:*:*:*:*:*:*:* Versions 75c Vulnerable ·SAP
cpe:2.3:a:sap:abap_platform:75d:*:*:*:*:*:*:* Versions 75d Vulnerable ·SAP
cpe:2.3:a:sap:abap_platform:75e:*:*:*:*:*:*:* Versions 75e Vulnerable ·SAP
cpe:2.3:a:sap:application_interface_framework:aif_703:*:*:*:*:*:*:* Versions aif_703 Vulnerable ·SAP
cpe:2.3:a:sap:application_interface_framework:aifx_702:*:*:*:*:*:*:* Versions aifx_702 Vulnerable ·SAP
cpe:2.3:a:sap:basis:755:*:*:*:*:*:*:* Versions 755 Vulnerable ·SAP
cpe:2.3:a:sap:basis:756:*:*:*:*:*:*:* Versions 756 Vulnerable ·SAP
cpe:2.3:a:sap:s4core:100:*:*:*:*:*:*:* Versions 100 Vulnerable ·SAP
cpe:2.3:a:sap:s4core:101:*:*:*:*:*:*:* Versions 101 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-29110
2026-10-03 Alias added: GHSA-666p-hwqx-vc2f

References

Advisory 1

https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Other 1

https://launchpad.support.sap.com/#/notes/3113349

TI-2021-19921 Code injection in SAP ABAP Server & ABAP Platform CVSS 3.1CRITICAL 9.8
TI-2024-14732 Code Injection vulnerability in SAP ABA (Application Basis) CVSS 3.1CRITICAL 9.1
TI-2020-05148 SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 700, 701, 702, 710, 711, 730… CVSS 3.1HIGH 8.8
TI-2020-05170 Code injection in SAP NetWeaver and ABAP Platform CVSS 3.1HIGH 7.2
TI-2023-10915 SQL Injection vulnerability in SAP ABAP Platform CVSS 3.1MEDIUM 6.8
TI-2020-05039 Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS… CVSS 3.1MEDIUM 5.8

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences