CVE-2026-0514

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0514", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2025-12-09T22:06:52.467Z", "datePublished": "2026-01-13T01:16:03.501Z", "dateUpdated": "2026-01-13T14:38:19.675Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SAP Business Connector", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "SAP BC 4.8"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Due to a Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious link. When an unsuspecting user clicks this link, the user may be redirected to a site controlled by the attacker. Successful exploitation could allow the attacker to access or modify information related to the webclient, impacting confidentiality and integrity, with no effect on availability.</p>"}], "value": "Due to a Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious link. When an unsuspecting user clicks this link, the user may be redirected to a site controlled by the attacker. Successful exploitation could allow the attacker to access or modify information related to the webclient, impacting confidentiality and integrity, with no effect on availability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation", "lang": "eng", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-01-13T01:16:03.501Z"}, "references": [{"url": "https://me.sap.com/notes/3666061"}, {"url": "https://url.sap/sapsecuritypatchday"}], "source": {"discovery": "UNKNOWN"}, "title": "Cross-Site Scripting (XSS) vulnerability in SAP Business Connector", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-13T14:38:12.759527Z", "id": "CVE-2026-0514", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T14:38:19.675Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0514", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T14:38:12.759527Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T14:38:16.619Z"}}], "cna": {"title": "Cross-Site Scripting (XSS) vulnerability in SAP Business Connector", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Business Connector", "versions": [{"status": "affected", "version": "SAP BC 4.8"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3666061"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Due to a Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious link. When an unsuspecting user clicks this link, the user may be redirected to a site controlled by the attacker. Successful exploitation could allow the attacker to access or modify information related to the webclient, impacting confidentiality and integrity, with no effect on availability.", "supportingMedia": [{"type": "text/html", "value": "<p>Due to a Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious link. When an unsuspecting user clicks this link, the user may be redirected to a site controlled by the attacker. Successful exploitation could allow the attacker to access or modify information related to the webclient, impacting confidentiality and integrity, with no effect on availability.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-01-13T01:16:03.501Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0514", "state": "PUBLISHED", "dateUpdated": "2026-01-13T14:38:19.675Z", "dateReserved": "2025-12-09T22:06:52.467Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-01-13T01:16:03.501Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP Business Connector", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "SAP BC 4.8"}]}], "source": "cna@sap.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:business_connector:4.8:*:*:*:*:*:*:*", "matchCriteriaId": "99F0C742-7E03-425D-BCFC-F4683843350F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to a Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious link. When an unsuspecting user clicks this link, the user may be redirected to a site controlled by the attacker. Successful exploitation could allow the attacker to access or modify information related to the webclient, impacting confidentiality and integrity, with no effect on availability."}, {"lang": "es", "value": "Debido a una vulnerabilidad de cross-site scripting (XSS) en SAP Business Connector, un atacante no autenticado podr\u00eda crear un enlace malicioso. Cuando un usuario desprevenido hace clic en este enlace, el usuario podr\u00eda ser redirigido a un sitio controlado por el atacante. La explotaci\u00f3n exitosa podr\u00eda permitir al atacante acceder o modificar informaci\u00f3n relacionada con el cliente web, lo que afectar\u00eda la confidencialidad y la integridad, sin efecto en la disponibilidad."}], "id": "CVE-2026-0514", "lastModified": "2026-06-17T10:10:52.657", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0514", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-13T14:38:12.759527Z", "version": "2.0.3"}}]}, "published": "2026-01-13T02:15:54.113", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required"], "url": "https://me.sap.com/notes/3666061"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T19:15:07.569381+00:00", "value": {"mitigation_remediation": ["Apply the SAP security patch referenced in SAP Note\u00a03666061 to correct the XSS flaw.", "Verify that the SAP Business Connector webclient is configured to sanitize all user\u2011supplied input before rendering.", "If patching cannot be performed immediately, restrict access to the webclient or implement CSP headers that block navigation to untrusted domains to reduce the risk of redirected exploitation."], "summary": {"action": "Apply Patch", "impact": "Client\u2011side XSS redirect"}, "threat_synthesis": {"affected_systems": "The affected product is SAP Business Connector from SAP, specifically version\u00a04.8 as identified by the CPE. The flaw applies to any deployment that serves the webclient interface to users.", "description_and_impact": "This vulnerability allows an unauthenticated attacker to construct a malicious link that, when clicked by a user of the SAP Business Connector webclient, redirects the browser to a site controlled by the attacker. The cross\u2011site scripting defect can also enable the attacker to read or modify data stored in the webclient, thereby compromising confidentiality and integrity. No impact on availability is anticipated.", "risk_and_exploitability": "The CVSS base score of\u00a06.1 indicates medium severity. The EPSS score is less than\u00a01\u202f%, suggesting that the likelihood of exploitation in the wild is low. The flaw is not listed in the CISA KEV catalog. Exploitation does not require authentication; the attacker simply needs a victim to click the crafted link. Because the flaw is client\u2011side, the critical condition for exploitation is user interaction with the malicious URL."}}}}, "created": "2026-01-13T09:27:02.628027+00:00", "updated": "2026-04-18T19:15:10.618863+00:00", "vendors": ["sap", "sap$PRODUCT$business_connector"]}