TI-2023-16858 Aliases CVE-2023-33991 GHSA-2xvc-p88c-94vw

Stored Cross-Site Scripting (Stored XSS) vulnerability in SAP UI5 Variant Management

LOW 36CWE-79Published 2023-06-13 · Updated 2025-01-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · Low · Low
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

SAP UI5 Variant Management - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, does not sufficiently encode user-controlled inputs on reading data from the server, resulting in Stored Cross-Site Scripting (Stored XSS) vulnerability. After successful exploitation, an attacker with user level access can cause high impact on confidentiality, modify some information and can cause unavailability of the application at user level.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00481 41st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP UI5 Variant Management	SAP_UI 750; SAP_UI 754; SAP_UI 755; SAP_UI 756; SAP_UI 757; UI_700 200	—	No fix listed	CNA

SAP UI5 Variant Management VendorSAP Affected SAP_UI 750; SAP_UI 754; SAP_UI 755; SAP_UI 756; SAP_UI 757; UI_700 200 Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:ui:700:::::::*	700	Vulnerable	SAP
cpe:2.3:a:sap:ui:750:::::::*	750	Vulnerable	SAP
cpe:2.3:a:sap:ui:754:::::::*	754	Vulnerable	SAP
cpe:2.3:a:sap:ui:755:::::::*	755	Vulnerable	SAP
cpe:2.3:a:sap:ui:756:::::::*	756	Vulnerable	SAP
cpe:2.3:a:sap:ui:757:::::::*	757	Vulnerable	SAP

cpe:2.3:a:sap:ui:700:*:*:*:*:*:*:* Versions 700 Vulnerable ·SAP
cpe:2.3:a:sap:ui:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
cpe:2.3:a:sap:ui:754:*:*:*:*:*:*:* Versions 754 Vulnerable ·SAP
cpe:2.3:a:sap:ui:755:*:*:*:*:*:*:* Versions 755 Vulnerable ·SAP
cpe:2.3:a:sap:ui:756:*:*:*:*:*:*:* Versions 756 Vulnerable ·SAP
cpe:2.3:a:sap:ui:757:*:*:*:*:*:*:* Versions 757 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-33991
2026-10-03 Alias added: GHSA-2xvc-p88c-94vw

References

Advisory 1

https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Other 1

https://launchpad.support.sap.com/#/notes/3324285

TI-2018-01809 Improper input validation in SAP HANA Database CVSS 3.0CRITICAL 9.8
TI-2018-01812 Under certain conditions SAP UI5 Handler allows an attacker to access information which… CVSS 3.0MEDIUM 5.3
TI-2019-00317 Authentication bypass by spoofing in SAP UI CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences