PT-2008-3377 · Sap · Sap Netweaver

Jaime Blasco · Publicado 2008-04-16 · Atualizado 2018-10-11 · CVE-2008-1846

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver versions prior to 7.0 SP15

Description The issue concerns the default configuration of SAP NetWeaver, where the "Always Use Secure HTML Editor" parameter is not enabled, allowing remote attackers to conduct cross-site scripting (XSS) attacks by entering feedback for a file.

Recommendations For SAP NetWeaver versions prior to 7.0 SP15, enable the "Always Use Secure HTML Editor" parameter to prevent cross-site scripting attacks.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-1846

Produtos afetados

Sap Netweaver

Referências · 8

• http://securityfocus.com/bid/28699 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1846 · Nota de Segurança
• http://aitsec.com/vulnerability-SAP-Netweaver-6.40-7.0-Cross-Site-Scripting.php · Nota
• http://securityreason.com/securityalert/3812 · Nota
• http://securityfocus.com/archive/1/490625/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41735 · Nota
• http://securitytracker.com/id?1019822 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1846 · Nota