Coupa Total Spend Management Platform script injection flaws
Someone could secretly alter what you see on a company purchasing website.
Summary
Flaws in the Tenders module of the Coupa Supplier Portal let attackers inject scripts and HTML. An attacker with a low-privileged account could run scripts in a victim's browser or alter what they see. This SaaS platform is run by the vendor, so users install nothing.
What to do
We have not confirmed a fixed version yet. Check the source links below.
Products and platforms
CVE IDs
Sources
Times
First published
First seen