CVEvulnerability
CVE-2008-2421
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-05-23
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0, Web Dynpro for ABAP (aka WD4A or WDA), and Web Dynpro for BSP allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under bc/gui/sap/its/webgui/.
Affected configurations
• sap sap web application server 7.0
• sap web dynpro abap
• sap web dynpro bsp
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://secunia.com/advisories/30334 Vendor Advisory
- http://www.securityfocus.com/archive/1/492376/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/29317 Exploit
- http://www.securitytracker.com/id?1020097 www.securitytracker.com
- http://www.vupen.com/english/advisories/2008/1599/references www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42724 exchange.xforce.ibmcloud.com
- http://secunia.com/advisories/30334 Vendor Advisory
- http://www.securityfocus.com/archive/1/492376/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/29317 Exploit
- http://www.securitytracker.com/id?1020097 www.securitytracker.com
- http://www.vupen.com/english/advisories/2008/1599/references www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42724 exchange.xforce.ibmcloud.com