PT-2015-1825 · Sap · Sap Afaria

Dmitry Chastukhin · Published 2015-08-24 · Updated 2018-12-10 · CVE-2015-6663

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP Afaria version 7

Description The issue exists due to insufficient protection of the web page structure in the Device Inspector page of the SAP Afaria mobile device management program. This allows a remote attacker to inject arbitrary HTML code using a specially crafted request. The vulnerability can be exploited by injecting arbitrary web script or HTML via crafted client name data in the Client form on the Device Inspector page.

Recommendations For SAP Afaria version 7, consider restricting access to the Device Inspector page until a fix is available. As a temporary workaround, avoid using specially crafted client name data in the Client form to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2015-11171

CVE-2015-6663

Affected Products

Sap Afaria

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2015-6663 · Security Note
• https://bdu.fstec.ru/vul/2015-11171 · Security Note
• http://erpscan.com/advisories/erpscan-15-019-sap-afaria-stored-xss · Note
• http://seclists.org/fulldisclosure/2015/Nov/95 · Note
• http://securityfocus.com/archive/1/536956/100/0/threaded · Note
• https://erpscan.io/advisories/erpscan-15-019-sap-afaria-stored-xss · Note
• http://packetstormsecurity.com/files/134508/SAP-Afaria-7-Cross-Site-Scripting.html · Note