PT-2016-1281 · Sap · Sap Netweaver

Vahagn Vardanyan · Publicado 2016-02-16 · Atualizado 2018-12-10 · CVE-2016-2387

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver version 7.4

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the Java Proxy Runtime ProxyServer servlet. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the ns or interface parameter to "ProxyServer/register". The vulnerability exists due to the lack of protection of the web page structure, which can be exploited by a remote attacker to inject arbitrary web or HTML code.

Recommendations For SAP NetWeaver version 7.4, apply the fix as described in SAP Security Note 2220571 to resolve the issue. As a temporary workaround, consider restricting access to the ProxyServer/register endpoint to minimize the risk of exploitation. Avoid using the ns and interface parameters in the affected API endpoint until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2016-00578

CVE-2016-2387

Produtos afetados

Sap Netweaver

Referências · 9

• https://bdu.fstec.ru/vul/2016-00578 · Nota de Segurança
• http://packetstormsecurity.com/files/137045/SAP-NetWeaver-AS-JAVA-7.4-Cross-Site-Scripting.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-2387 · Nota de Segurança
• http://seclists.org/fulldisclosure/2016/May/39 · Nota
• https://erpscan.io/advisories/erpscan-16-008-sap-netweaver-7-4-proxyserver-servlet-xss-vulnerability · Nota
• https://erpscan.com/press-center/blog/sap-security-notes-february-2016-review · Nota
• https://erpscan.com/advisories/erpscan-16-008-sap-netweaver-7-4-proxyserver-servlet-xss-vulnerability · Nota
• https://osv.dev/vulnerability/CVE-2016-2387 · Aviso do Fabricante
• https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review · Nota