PT-2016-1281 · Sap · Sap Netweaver

Vahagn Vardanyan · Published 2016-02-16 · Updated 2018-12-10 · CVE-2016-2387

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver version 7.4

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the Java Proxy Runtime ProxyServer servlet. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the ns or interface parameter to "ProxyServer/register". The vulnerability exists due to the lack of protection of the web page structure, which can be exploited by a remote attacker to inject arbitrary web or HTML code.

Recommendations For SAP NetWeaver version 7.4, apply the fix as described in SAP Security Note 2220571 to resolve the issue. As a temporary workaround, consider restricting access to the ProxyServer/register endpoint to minimize the risk of exploitation. Avoid using the ns and interface parameters in the affected API endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2016-00578

CVE-2016-2387

Affected Products

Sap Netweaver

References · 9

• https://bdu.fstec.ru/vul/2016-00578 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-2387 · Security Note
• https://osv.dev/vulnerability/CVE-2016-2387 · Vendor Advisory
• http://packetstormsecurity.com/files/137045/SAP-NetWeaver-AS-JAVA-7.4-Cross-Site-Scripting.html · Note
• http://seclists.org/fulldisclosure/2016/May/39 · Note
• https://erpscan.io/advisories/erpscan-16-008-sap-netweaver-7-4-proxyserver-servlet-xss-vulnerability · Note
• https://erpscan.com/press-center/blog/sap-security-notes-february-2016-review · Note
• https://erpscan.com/advisories/erpscan-16-008-sap-netweaver-7-4-proxyserver-servlet-xss-vulnerability · Note
• https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review · Note