PT-2010-4392 · Sap · Sap Netweaver

Published 2010-07-28 · Updated 2017-08-17 · CVE-2010-2904

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver versions 6.4 through 7.02

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the System Landscape Directory (SLD) component. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the action parameter to testsdic and the helpstring parameter to paramhelp.jsp are vulnerable.

Recommendations For SAP NetWeaver versions 6.4 through 7.02, consider restricting access to the testsdic and paramhelp.jsp endpoints until a fix is available. As a temporary workaround, avoid using the action parameter in the testsdic endpoint and the helpstring parameter in the paramhelp.jsp endpoint.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-2904

Affected Products

Sap Netweaver

References · 9

• http://vupen.com/english/advisories/2010/1935 · Vendor Advisory
• http://secunia.com/advisories/40712 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2904 · Security Note
• http://osvdb.org/66639 · Note
• http://packetstormsecurity.org/1007-advisories/DSECRG-09-068.txt · Note
• https://service.sap.com/sap/support/notes/1416047 · Note
• http://osvdb.org/66640 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/60668 · Note
• http://dsecrg.com/pages/vul/show.php?id=168 · Note