CVE-2023-24529 Cross-site scripting in NetWeaver AS ABAP (Business Server Pages application)

Medium 6.1 Published 14 Feb 2023 Updated 20 Mar 2025

Reflected XSS in SAP NetWeaver BSP allows attackers to hijack sessions and access sensitive data via malicious inputs.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-24529?

CVE-2023-24529 is a medium-severity cross-site scripting vulnerability in SAP NetWeaver AS ABAP (Business Server Pages application), published on 14 Feb 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Due to lack of proper input validation, BSP application (CRM_BSP_FRAME) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H, allow malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a Reflected Cross-Site Scripting (XSS) attack. As a result, an attacker may be able to hijack a user session, read and modify some sensitive information.

Weakness: CWE-79

Which versions are affected by CVE-2023-24529?

It affects 1 product.

Products include Sap Netweaver as Abap Business Server Pages.

How do I fix CVE-2023-24529?

No fix has been published for CVE-2023-24529 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-24529 being exploited?

There is no known exploitation of CVE-2023-24529 in the wild and no public exploit code.

Sources

Also known as GHSA-jcxw-8wmf-frrv.