CVEvulnerability
CVE-2010-2904
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2010-07-28
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in the System Landscape Directory (SLD) component 6.4 through 7.02 in SAP NetWeaver allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter to testsdic and the (2) helpstring parameter to paramhelp.jsp.
Affected configurations
• sap system landscape directory 6.4
• sap system landscape directory 7.0
• sap system landscape directory 7.02
• sap netweaver
• sap netweaver 6.4
• sap netweaver 7.0
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://dsecrg.com/pages/vul/show.php?id=168 dsecrg.com
- http://packetstormsecurity.org/1007-advisories/DSECRG-09-068.txt packetstormsecurity.org
- http://secunia.com/advisories/40712 Vendor Advisory
- http://www.osvdb.org/66639 www.osvdb.org
- http://www.osvdb.org/66640 www.osvdb.org
- http://www.vupen.com/english/advisories/2010/1935 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/60668 exchange.xforce.ibmcloud.com
- https://service.sap.com/sap/support/notes/1416047 service.sap.com
- http://dsecrg.com/pages/vul/show.php?id=168 dsecrg.com
- http://packetstormsecurity.org/1007-advisories/DSECRG-09-068.txt packetstormsecurity.org
- http://secunia.com/advisories/40712 Vendor Advisory
- http://www.osvdb.org/66639 www.osvdb.org
- http://www.osvdb.org/66640 www.osvdb.org
- http://www.vupen.com/english/advisories/2010/1935 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/60668 exchange.xforce.ibmcloud.com
- https://service.sap.com/sap/support/notes/1416047 service.sap.com