CVE-2023-24529: SAP NetWeaver As Abap Business Server Pages

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Due to lack of proper input validation, BSP application (CRM_BSP_FRAME) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H, allow malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a Reflected Cross-Site Scripting (XSS) attack. As a result, an attacker may be able to hijack a user session, read and modify some sensitive information.

Affected products

• SAP NetWeaver As Abap Business Server Pages: version 7.00 only; version 7.01 only; version 7.02 only; version 7.31 only; version 7.40 only; version 7.50 only; …

Published 2023-02-14. Last modified 2026-06-17.