PT-2017-16871 · Sap · Sap Businessobjects Financial Consolidation

Published 2017-03-16 · Updated 2017-03-16 · CVE-2017-6061

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Financial Consolidation version 10.0.0.1933

Description A cross-site scripting (XSS) issue exists in the help component, allowing remote attackers to inject arbitrary web script or HTML via a GET request to the "/finance/help/en/frameset.htm" API endpoint. This could potentially lead to unauthorized actions on the affected system.

Recommendations For SAP BusinessObjects Financial Consolidation version 10.0.0.1933, apply the fix as described in SAP Security Note 2368106 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-6061

Affected Products

Sap Businessobjects Financial Consolidation

References · 6

• http://packetstormsecurity.com/files/141349/SAP-BusinessObjects-Financial-Consolidation-10.0.0.1933-Cross-Site-Scripting.html · Patch
• https://osv.dev/vulnerability/CVE-2017-6061 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6061 · Security Note
• http://securitytracker.com/id/1037910 · Patch
• http://seclists.org/fulldisclosure/2017/Feb/69 · Patch
• http://securityfocus.com/bid/96461 · Note