SAPUI5 vulnerabilities

SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequently opens the adapted application, the injected script executes in the victim's browser session.

The setThemeRoot() function fails to enforce the sap-allowed-theme-origins allowlist. An attacker can store and use a controlled absolute cross-origin URL to construct a <link rel=stylesheet> element, even without the <meta name=sap-allowed-theme-origins> tag. The bypass is also reachable via the ?sap-themeRoot URL parameter.

In SAPUI5 (Search UI), an unauthenticated attacker can manipulate specific URL parameters in the Search UI to include malicious content. Successful exploitation may mislead victim users into clicking and accessing attacker-controlled pages rendered by the application. This vulnerability has a low impact on confidentiality with no effect on integrity and availability.