CVE-2023-29112

CVE-2023-29112 describes a medium-severity cross-site scripting (XSS) vulnerability in SAP Application Interface (Message Monitoring) versions 600 and 700. An authorized attacker can inject malicious HTML, including links and custom CSS classes, into comments, which are then rendered by the application. This could lead to a limited impact on the confidentiality and integrity of the application. The vulnerability has a CVSS score of 5.4, indicating a medium severity, and requires user interaction (UI:R) for exploitation, as an attacker needs to trick a victim into viewing the crafted comment. The attack complexity is low (AC:L), and it affects the integrity and confidentiality of the application (C:L, I:L). Currently, there is no evidence of active exploitation, nor is there any publicly available exploit code in Metasploit, Nuclei, or ExploitDB. The vulnerability has also received minimal community discussion and media coverage, suggesting a low level of public awareness or concern.