CVE-2023-29112: SAP Application Interface

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

The SAP Application Interface (Message Monitoring) - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a comment. The comment will render links and custom CSS classes as HTML objects. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application.

Affected products

• SAP Application Interface: version 600 only; version 700 only

Published 2023-04-11. Last modified 2026-06-17.