Lucene search

[email protected]CVE-2007-3496

HistoryJun 29, 2007 - 6:30 p.m.

CVE-2007-3496

2007-06-2918:30:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

sap

web dynpro

java

xss

vulnerability

netweaver

nw04

nvd

security

sap java technology services

sap web dynpro runtime core components

6.3 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.006 Low

EPSS

Percentile

79.2%

JSON

Cross-site scripting (XSS) vulnerability in SAP Web Dynpro Java (BC-WD-JAV) in SAP NetWeaver Nw04 SP15 through SP19 and Nw04s SP7 through SP11, aka SAP Java Technology Services 640 before SP20 and SAP Web Dynpro Runtime Core Components 700 before SP12, allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.

CPENameOperatorVersion
sap:netweaver_nw04sap netweaver nw04eqsp19
sap:sap_basis_component_700sap sap basis component 700lesp11
sap:netweaver_nw04sap netweaver nw04eqsp16
sap:netweaver_nw04ssap netweaver nw04seqsp8
sap:netweaver_nw04ssap netweaver nw04seqsp9
sap:netweaver_nw04ssap netweaver nw04seqsp7
sap:netweaver_nw04sap netweaver nw04eqsp18
sap:sap_basis_component_640sap sap basis component 640lesp19
sap:netweaver_nw04sap netweaver nw04eqsp15
sap:netweaver_nw04ssap netweaver nw04seqsp11

CPE	Name	Operator	Version
sap:netweaver_nw04	sap netweaver nw04	eq	sp19
sap:sap_basis_component_700	sap sap basis component 700	le	sp11
sap:netweaver_nw04	sap netweaver nw04	eq	sp16
sap:netweaver_nw04s	sap netweaver nw04s	eq	sp8
sap:netweaver_nw04s	sap netweaver nw04s	eq	sp9
sap:netweaver_nw04s	sap netweaver nw04s	eq	sp7
sap:netweaver_nw04	sap netweaver nw04	eq	sp18
sap:sap_basis_component_640	sap sap basis component 640	le	sp19
sap:netweaver_nw04	sap netweaver nw04	eq	sp15
sap:netweaver_nw04s	sap netweaver nw04s	eq	sp11

Rows per page:

1-10 of 121

References

osvdb.org/37748

secunia.com/advisories/25866

securityreason.com/securityalert/2850

www.csnc.ch/advisory/sap01.html

www.securityfocus.com/archive/1/472341/100/0/threaded

www.vupen.com/english/advisories/2007/2381

6.3 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.006 Low

EPSS

Percentile

79.2%

JSON

Related for CVE-2007-3496

prion1 cvelist1