PT-2008-3377 · Sap · Sap Netweaver

Jaime Blasco · Published 2008-04-16 · Updated 2018-10-11 · CVE-2008-1846

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver versions prior to 7.0 SP15

Description The issue concerns the default configuration of SAP NetWeaver, where the "Always Use Secure HTML Editor" parameter is not enabled, allowing remote attackers to conduct cross-site scripting (XSS) attacks by entering feedback for a file.

Recommendations For SAP NetWeaver versions prior to 7.0 SP15, enable the "Always Use Secure HTML Editor" parameter to prevent cross-site scripting attacks.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-1846

Affected Products

Sap Netweaver

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2008-1846 · Security Note
• http://securityfocus.com/bid/28699 · Note
• http://aitsec.com/vulnerability-SAP-Netweaver-6.40-7.0-Cross-Site-Scripting.php · Note
• http://securityreason.com/securityalert/3812 · Note
• http://securityfocus.com/archive/1/490625/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41735 · Note
• http://securitytracker.com/id?1019822 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1846 · Note