PT-2007-4757 · Sap · Sap Java Technology Services+2

Published 2007-06-29 · Updated 2018-10-16 · CVE-2007-3496

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver versions Nw04 SP15 through SP19 SAP NetWeaver versions Nw04s SP7 through SP11 SAP Java Technology Services version 640 before SP20 SAP Web Dynpro Runtime Core Components version 700 before SP12

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.

Recommendations For SAP NetWeaver versions Nw04 SP15 through SP19, update to a version after SP19. For SAP NetWeaver versions Nw04s SP7 through SP11, update to a version after SP11. For SAP Java Technology Services version 640 before SP20, update to SP20 or later. For SAP Web Dynpro Runtime Core Components version 700 before SP12, update to SP12 or later.

Fix

Related Identifiers

CVE-2007-3496

Affected Products

Sap Java Technology Services

Sap Netweaver

Sap Web Dynpro Runtime Core Components

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-3496 · Security Note
• http://secunia.com/advisories/25866 · Note
• http://osvdb.org/37748 · Note
• http://vupen.com/english/advisories/2007/2381 · Note
• http://securityreason.com/securityalert/2850 · Note
• http://securityfocus.com/archive/1/472341/100/0/threaded · Note
• http://csnc.ch/advisory/sap01.html · Note