SAP UI vulnerabilities

4 CVEs affecting SAP UI, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-33991, published 2023-06-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-2424, published 2018-06-12. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to the DOM that could steal user information. Software…
CVE-2018-2428, published 2018-06-12. Medium severity, CVSS 5.3. EPSS: 1.7% chance of exploitation in the next 30 days. Under certain conditions SAP UI5 Handler allows an attacker to access information which would otherwise be restricted. Software components affected are: SAP Infrastructure 1.0, SAP UI 7.4, 7.5, 7.51,…
CVE-2019-0388, published 2019-11-13. Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days. SAP UI5 HTTP Handler (corrected in SAP_UI versions 7.5, 7.51, 7.52, 7.53, 7.54 and SAP UI_700 version 2.0) allows an attacker to manipulate content due to insufficient URL validation.
CVE-2023-33991, published 2023-06-13. High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days. SAP UI5 Variant Management - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, does not sufficiently encode user-controlled inputs on reading data from the server,…