{"api_version":"1","generated_at":"2026-07-23T11:05:10+00:00","cve":"CVE-2014-9569","urls":{"html":"https://cve.report/CVE-2014-9569","api":"https://cve.report/api/cve/CVE-2014-9569.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-9569","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-9569"},"summary":{"title":"CVE-2014-9569","description":"Multiple cross-site scripting (XSS) vulnerabilities in SAP NetWeaver Business Client (NWBC) for HTML 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) roundtrips parameter, aka SAP Security Note 2051285.","state":"PUBLISHED","assigner":"mitre","published_at":"2015-01-07 19:59:03","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.senseofsecurity.com.au/advisories/SOS-14-005","name":"http://www.senseofsecurity.com.au/advisories/SOS-14-005","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","URL Repurposed"],"title":"Sense of Security - Security Advisory - SOS-14-005 - SAP NetWeaver Business Client for HTML Cross-site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1031509","name":"http://www.securitytracker.com/id/1031509","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SAP NetWeaver Business Client for HTML Input Validation Flaws Permit Cross-Site Scripting Attacks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/62017","name":"http://secunia.com/advisories/62017","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA62017 - SAP NetWeaver Business Client NWBC Cross-Site Scripting Vulnerabilities - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9569","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9569","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"9569","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"netweaver_business_client_for_html","cpe6":"3.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T13:47:41.660Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"62017","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/62017"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.senseofsecurity.com.au/advisories/SOS-14-005"},{"name":"1031509","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1031509"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-12-14T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in SAP NetWeaver Business Client (NWBC) for HTML 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) roundtrips parameter, aka SAP Security Note 2051285."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-12-30T16:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"62017","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/62017"},{"tags":["x_refsource_MISC"],"url":"http://www.senseofsecurity.com.au/advisories/SOS-14-005"},{"name":"1031509","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1031509"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-9569","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in SAP NetWeaver Business Client (NWBC) for HTML 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) roundtrips parameter, aka SAP Security Note 2051285."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"62017","refsource":"SECUNIA","url":"http://secunia.com/advisories/62017"},{"name":"http://www.senseofsecurity.com.au/advisories/SOS-14-005","refsource":"MISC","url":"http://www.senseofsecurity.com.au/advisories/SOS-14-005"},{"name":"1031509","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1031509"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-9569","datePublished":"2015-01-07T19:00:00.000Z","dateReserved":"2015-01-07T00:00:00.000Z","dateUpdated":"2024-08-06T13:47:41.660Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-01-07 19:59:03","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sap:netweaver_business_client_for_html:3.0:*:*:*:*:*:*:*","matchCriteriaId":"7A028538-3CD2-4B9D-B34F-B1F4AEEC8AE5"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"9569","Ordinal":"1","Title":"CVE-2014-9569","CVE":"CVE-2014-9569","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"9569","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in SAP NetWeaver Business Client (NWBC) for HTML 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) roundtrips parameter, aka SAP Security Note 2051285.","Type":"Description","Title":"CVE-2014-9569"},{"CveYear":"2014","CveId":"9569","Ordinal":"2","NoteData":"2015-01-07","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"9569","Ordinal":"3","NoteData":"2016-12-30","Type":"Other","Title":"Modified"}]}}}