Lucene search

[email protected]CVE-2008-2421

HistoryMay 23, 2008 - 3:32 p.m.

CVE-2008-2421

2008-05-2315:32:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2008-2421

cross-site scripting

xss

sap web application server

web gui

security vulnerability

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.874 High

EPSS

Percentile

98.7%

JSON

Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0, Web Dynpro for ABAP (aka WD4A or WDA), and Web Dynpro for BSP allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under bc/gui/sap/its/webgui/.

Affected configurations

NVD

Node

sapsap_web_application_serverMatch7.0

sapweb_dynproMatchabap

sapweb_dynproMatchbsp

CPENameOperatorVersion
sap:sap_web_application_serversap sap web application servereq7.0
sap:web_dynprosap web dynproeqabap
sap:web_dynprosap web dynproeqbsp

CPE	Name	Operator	Version
sap:sap_web_application_server	sap sap web application server	eq	7.0
sap:web_dynpro	sap web dynpro	eq	abap
sap:web_dynpro	sap web dynpro	eq	bsp

References

secunia.com/advisories/30334

www.securityfocus.com/archive/1/492376/100/0/threaded

www.securityfocus.com/bid/29317

www.securitytracker.com/id?1020097

www.vupen.com/english/advisories/2008/1599/references

exchange.xforce.ibmcloud.com/vulnerabilities/42724

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.874 High

EPSS

Percentile

98.7%

JSON

Related for CVE-2008-2421

prion1 cvelist1 nvd1