CVE-2023-42479: SAP Biller Direct

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

An unauthenticated attacker can embed a hidden access to a Biller Direct URL in a frame which, when loaded by the user, will submit a cross-site scripting request to the Biller Direct system. This can result in the disclosure or modification of non-sensitive information.

Affected products

• SAP Biller Direct: version 635 only; version 750 only

Published 2023-12-12. Last modified 2026-06-17.