VDB
CVE-2023-49577
CVE-2023-49577
PUBLISHED
CVSS 6.1 MEDIUM
Cross-Site Scripting (XSS) vulnerability in the SAP HCM (SMART PAYE solution)
Reported by sap · Published December 12, 2023
The SAP HCM (SMART PAYE solution) - versions S4HCMCIE 100, SAP_HRCIE 600, SAP_HRCIE 604, SAP_HRCIE 608, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.
Risk scores
CVSS 3.1
6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP HCM (SMART PAYE solution) | S4HCMCIE 100, SAP_HRCIE 600, SAP_HRCIE 604 |
| SAP_SE | SAP HCM (SMART PAYE solution) | * |
Timeline
- Dec 11, 2023 CVE Published
- Dec 12, 2023 EPSS Score (30 in total, the first dated here)
- Oct 5, 2024 Coalition ESS Score (4 in total, the first dated here)
- Mar 30, 2026 Security Advisory
- Jun 17, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2023-49577
vulnetix vdb fixes CVE-2023-49577Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-49577/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart