CVE Vulnerability

CVE-2008-1846

The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" (aka Editor Security or Secure Editing) parameter, which allows remote attackers to conduct cross-site scripting (XSS) attacks by entering feedback for a file.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

References
Link Resource
http://www.aitsec.com/vulnerability-SAP-Netweaver-6.40-7.0-Cross-Site-Scripting.php
http://www.securityfocus.com/bid/28699
http://www.securitytracker.com/id?1019822
http://securityreason.com/securityalert/3812
https://exchange.xforce.ibmcloud.com/vulnerabilities/41735
http://www.securityfocus.com/archive/1/490625/100/0/threaded
Configurations

Configuration 1

cpe:2.3:a:sap:netweaver:*:sp8:*:*:*:*:*:*
Information

Published : 2008-04-16 05:05

Updated : 2018-10-11 08:37

NVD link : CVE-2008-1846

Mitre link : CVE-2008-1846

Products Affected
No products.
CWE
CWE-79