Lucene search

MitreCVE-2017-11460

HistoryJul 25, 2017 - 6:29 p.m.

CVE-2017-11460

2017-07-2518:29:01

CWE-79

mitre

web.nvd.nist.gov

cve-2017-11460

xss vulnerability

dataarchivingservice servlet

sap

netweaver portal 7.4

security vulnerability

remote code injection

nvd

sap security note 2308535

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

47.7%

JSON

Cross-site scripting (XSS) vulnerability in the DataArchivingService servlet in SAP NetWeaver Portal 7.4 allows remote attackers to inject arbitrary web script or HTML via the responsecode parameter to shp/shp_result.jsp, aka SAP Security Note 2308535.

Affected configurations

Nvd

Node

sapnetweaver_portalMatch7.4

VendorProductVersionCPE
sapnetweaver_portal7.4cpe:2.3:a:sap:netweaver_portal:7.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	netweaver_portal	7.4	cpe:2.3:a:sap:netweaver_portal:7.4:::::::*

References

www.securityfocus.com/bid/101826

www.securityfocus.com/bid/97565

erpscan.io/advisories/erpscan-17-016-sap-netweaver-java-7-4-dataarchivingservice-servlet-xss/

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

47.7%

JSON

Related for CVE-2017-11460