CVE-2023-0013 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

Medium 6.1 Published 10 Jan 2023 Updated 9 Apr 2025

An attacker can execute arbitrary scripts in the ABAP Keyword Documentation, compromising confidentiality and integrity.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-0013?

CVE-2023-0013 is a medium-severity cross-site scripting vulnerability in Sap Netweaver Application Server Abap, published on 10 Jan 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The ABAP Keyword Documentation of SAP NetWeaver Application Server - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, for ABAP and ABAP Platform does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application.

Weakness: CWE-79

Which versions are affected by CVE-2023-0013?

It affects 1 product.

Products include Sap Netweaver Application Server Abap.

How do I fix CVE-2023-0013?

No fix has been published for CVE-2023-0013 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-0013 being exploited?

There is no known exploitation of CVE-2023-0013 in the wild and no public exploit code.

All Sap Netweaver Application Server Abap vulnerabilities

Sources

Also known as GHSA-chrg-5xr2-ppfm.