PT-2017-3751 · Sap · Sap Business Warehouse Universal Data Integration

Aleksandr Shvetsov + 2 · Published 2017-03-16 · Updated 2017-12-21 · CVE-2017-16685

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:N/AC:H/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions: SAP Business Warehouse Universal Data Integration versions 7.10 through 7.11 SAP Business Warehouse Universal Data Integration version 7.20 SAP Business Warehouse Universal Data Integration version 7.30 SAP Business Warehouse Universal Data Integration version 7.31 SAP Business Warehouse Universal Data Integration version 7.40 SAP Business Warehouse Universal Data Integration version 7.50

Description: The issue is related to Cross-Site scripting (XSS) due to insufficient encoding of user-controlled inputs, allowing a remote attacker to inject arbitrary code. This is caused by incorrect processing of user-provided data.

Recommendations: For SAP Business Warehouse Universal Data Integration versions 7.10 through 7.11, update to a version that properly encodes user-controlled inputs to prevent XSS attacks. For SAP Business Warehouse Universal Data Integration version 7.20, ensure proper encoding of user-controlled inputs to mitigate the risk of code injection. For SAP Business Warehouse Universal Data Integration version 7.30, apply necessary configuration changes to prevent insufficient encoding of user-controlled inputs. For SAP Business Warehouse Universal Data Integration version 7.31, restrict access to areas where user-controlled inputs are processed to minimize the risk of exploitation. For SAP Business Warehouse Universal Data Integration version 7.40, consider implementing additional validation for user-provided data to prevent code injection. For SAP Business Warehouse Universal Data Integration version 7.50, apply a fix that correctly handles user-controlled inputs to prevent XSS attacks.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2019-00306

CVE-2017-16685

Affected Products

Sap Business Warehouse Universal Data Integration

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2017-16685 · Security Note
• https://osv.dev/vulnerability/CVE-2017-16685 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00306 · Security Note
• https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017 · Vendor Advisory
• https://ptsecurity.com/ru-ru/research/threatscape/pt-2018-39 · Note
• https://securityfocus.com/bid/102148 · Note
• https://launchpad.support.sap.com/#/notes/2537545 · Note
• http://securityfocus.com/bid/102148 · Note