CVEvulnerability
CVE-2008-1846
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-04-16
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" (aka Editor Security or Secure Editing) parameter, which allows remote attackers to conduct cross-site scripting (XSS) attacks by entering feedback for a file.
Affected configurations
• sap netweaver (<= 7.0)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://securityreason.com/securityalert/3812 securityreason.com
- http://www.aitsec.com/vulnerability-SAP-Netweaver-6.40-7.0-Cross-Site-Scripting.php www.aitsec.com
- http://www.securityfocus.com/archive/1/490625/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/28699 www.securityfocus.com
- http://www.securitytracker.com/id?1019822 www.securitytracker.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41735 exchange.xforce.ibmcloud.com
- http://securityreason.com/securityalert/3812 securityreason.com
- http://www.aitsec.com/vulnerability-SAP-Netweaver-6.40-7.0-Cross-Site-Scripting.php www.aitsec.com
- http://www.securityfocus.com/archive/1/490625/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/28699 www.securityfocus.com
- http://www.securitytracker.com/id?1019822 www.securitytracker.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41735 exchange.xforce.ibmcloud.com