SAP Biller Direct vulnerabilities

2 CVEs affecting SAP Biller Direct, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-42479, published 2023-12-12.

More from SAP.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-42479, published 2023-12-12. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. An unauthenticated attacker can embed a hidden access to a Biller Direct URL in a frame which, when loaded by the user, will submit a cross-site scripting request to the Biller Direct system. This…
• CVE-2022-41207, published 2022-11-08. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. SAP Biller Direct allows an unauthenticated attacker to craft a legitimate looking URL. When clicked by an unsuspecting victim, it will use an unsensitized parameter to redirect the victim to a…