PT-2007-4756 · Sap · Sap Basis+1

Published 2007-06-29 · Updated 2018-10-16 · CVE-2007-3495

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP Basis component versions 700 before SP12 SAP Basis component versions 640 before SP20

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the SAP Internet Communication Framework (BC-MID-ICF). These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via certain parameters associated with the default login error page.

Recommendations For SAP Basis component versions 700 before SP12, update to SP12 or later to resolve the issue. For SAP Basis component versions 640 before SP20, update to SP20 or later to resolve the issue.

Fix

Related Identifiers

CVE-2007-3495

Affected Products

Sap Basis

Sap Internet Communication Framework

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-3495 · Security Note
• http://secunia.com/advisories/25866 · Note
• http://csnc.ch/advisory/sap02.html · Note
• http://osvdb.org/37749 · Note
• http://vupen.com/english/advisories/2007/2381 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35107 · Note
• http://securityreason.com/securityalert/2849 · Note
• http://securityfocus.com/archive/1/472345/100/0/threaded · Note