PT-2010-4392 · Sap · Sap Netweaver

Publicado 2010-07-28 · Atualizado 2017-08-17 · CVE-2010-2904

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver versions 6.4 through 7.02

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the System Landscape Directory (SLD) component. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the action parameter to testsdic and the helpstring parameter to paramhelp.jsp are vulnerable.

Recommendations For SAP NetWeaver versions 6.4 through 7.02, consider restricting access to the testsdic and paramhelp.jsp endpoints until a fix is available. As a temporary workaround, avoid using the action parameter in the testsdic endpoint and the helpstring parameter in the paramhelp.jsp endpoint.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-2904

Produtos afetados

Sap Netweaver

Referências · 9

• http://vupen.com/english/advisories/2010/1935 · Aviso do Fabricante
• http://osvdb.org/66639 · Nota
• http://packetstormsecurity.org/1007-advisories/DSECRG-09-068.txt · Nota
• https://service.sap.com/sap/support/notes/1416047 · Nota
• http://secunia.com/advisories/40712 · Aviso do Fabricante
• http://osvdb.org/66640 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/60668 · Nota
• http://dsecrg.com/pages/vul/show.php?id=168 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2904 · Nota de Segurança