CVE-2023-33991

CVE-2023-33991 is a Stored Cross-Site Scripting (XSS) vulnerability affecting SAP UI5 Variant Management in various SAP_UI and UI_700 versions. This flaw stems from insufficient encoding of user-controlled inputs when reading data from the server. An attacker with user-level access can exploit this to achieve high impact on confidentiality, modify information, and cause application unavailability. With a CVSS score of 8.2 (HIGH), it has a network attack vector, low attack complexity, and requires user interaction. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in CISA's KEV catalog, though it has received limited community discussion and media coverage.