PT-2017-16871 · Sap · Sap Businessobjects Financial Consolidation

Publicado 2017-03-16 · Atualizado 2017-03-16 · CVE-2017-6061

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Financial Consolidation version 10.0.0.1933

Description A cross-site scripting (XSS) issue exists in the help component, allowing remote attackers to inject arbitrary web script or HTML via a GET request to the "/finance/help/en/frameset.htm" API endpoint. This could potentially lead to unauthorized actions on the affected system.

Recommendations For SAP BusinessObjects Financial Consolidation version 10.0.0.1933, apply the fix as described in SAP Security Note 2368106 to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-6061

Produtos afetados

Sap Businessobjects Financial Consolidation

Referências · 6

• http://securityfocus.com/bid/96461 · Nota
• http://packetstormsecurity.com/files/141349/SAP-BusinessObjects-Financial-Consolidation-10.0.0.1933-Cross-Site-Scripting.html · Correção
• https://osv.dev/vulnerability/CVE-2017-6061 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6061 · Nota de Segurança
• http://securitytracker.com/id/1037910 · Correção
• http://seclists.org/fulldisclosure/2017/Feb/69 · Correção