PT-2015-1825 · Sap · Sap Afaria

Dmitry Chastukhin · Publicado 2015-08-24 · Atualizado 2018-12-10 · CVE-2015-6663

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP Afaria version 7

Description The issue exists due to insufficient protection of the web page structure in the Device Inspector page of the SAP Afaria mobile device management program. This allows a remote attacker to inject arbitrary HTML code using a specially crafted request. The vulnerability can be exploited by injecting arbitrary web script or HTML via crafted client name data in the Client form on the Device Inspector page.

Recommendations For SAP Afaria version 7, consider restricting access to the Device Inspector page until a fix is available. As a temporary workaround, avoid using specially crafted client name data in the Client form to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2015-11171

CVE-2015-6663

Produtos afetados

Sap Afaria

Referências · 7

• http://erpscan.com/advisories/erpscan-15-019-sap-afaria-stored-xss · Nota
• http://seclists.org/fulldisclosure/2015/Nov/95 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-6663 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-11171 · Nota de Segurança
• http://securityfocus.com/archive/1/536956/100/0/threaded · Nota
• https://erpscan.io/advisories/erpscan-15-019-sap-afaria-stored-xss · Nota
• http://packetstormsecurity.com/files/134508/SAP-Afaria-7-Cross-Site-Scripting.html · Nota