CVE-2026-0514

Due to a Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious link. When an unsuspecting user clicks this link, the user may be redirected to a site controlled by the attacker. Successful exploitation could allow the attacker to access or modify information related to the webclient, impacting confidentiality and integrity, with no effect on availability.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://me.sap.com/notes/3666061	Permissions Required
https://url.sap/sapsecuritypatchday	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:business_connector:4.8:*:*:*:*:*:*:*

History

17 Jun 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Debido a una vulnerabilidad de cross-site scripting (XSS) en SAP Business Connector, un atacante no autenticado podría crear un enlace malicioso. Cuando un usuario desprevenido hace clic en este enlace, el usuario podría ser redirigido a un sitio controlado por el atacante. La explotación exitosa podría permitir al atacante acceder o modificar información relacionada con el cliente web, lo que afectaría la confidencialidad y la integridad, sin efecto en la disponibilidad.

16 Jan 2026, 16:53

Type	Values Removed	Values Added
References	~~() https://me.sap.com/notes/3666061 -~~	() https://me.sap.com/notes/3666061 - Permissions Required
References	~~() https://url.sap/sapsecuritypatchday -~~	() https://url.sap/sapsecuritypatchday - Vendor Advisory
CPE		cpe:2.3:a:sap:business_connector:4.8:::::::*
First Time		Sap Sap business Connector

13 Jan 2026, 02:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-13 02:15

Updated : 2026-06-17 10:10

NVD link : CVE-2026-0514

Mitre link : CVE-2026-0514

CVE.ORG link : CVE-2026-0514

JSON object : View

Products Affected

sap

business_connector

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-0514", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0514", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T14:38:12.759527Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP Business Connector", "versions": [{"status": "affected", "version": "SAP BC 4.8"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-13T02:15:54.113", "references": [{"url": "https://me.sap.com/notes/3666061", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Due to a Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious link. When an unsuspecting user clicks this link, the user may be redirected to a site controlled by the attacker. Successful exploitation could allow the attacker to access or modify information related to the webclient, impacting confidentiality and integrity, with no effect on availability."}, {"lang": "es", "value": "Debido a una vulnerabilidad de cross-site scripting (XSS) en SAP Business Connector, un atacante no autenticado podr\u00eda crear un enlace malicioso. Cuando un usuario desprevenido hace clic en este enlace, el usuario podr\u00eda ser redirigido a un sitio controlado por el atacante. La explotaci\u00f3n exitosa podr\u00eda permitir al atacante acceder o modificar informaci\u00f3n relacionada con el cliente web, lo que afectar\u00eda la confidencialidad y la integridad, sin efecto en la disponibilidad."}], "lastModified": "2026-06-17T10:10:52.657", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:business_connector:4.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "99F0C742-7E03-425D-BCFC-F4683843350F"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}