CVE-2007-3496

Cross-site scripting (XSS) vulnerability in SAP Web Dynpro Java (BC-WD-JAV) in SAP NetWeaver Nw04 SP15 through SP19 and Nw04s SP7 through SP11, aka SAP Java Technology Services 640 before SP20 and SAP Web Dynpro Runtime Core Components 700 before SP12, allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://osvdb.org/37748
http://secunia.com/advisories/25866
http://securityreason.com/securityalert/2850
http://www.csnc.ch/advisory/sap01.html
http://www.securityfocus.com/archive/1/472341/100/0/threaded
http://www.vupen.com/english/advisories/2007/2381

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sap:netweaver_nw04:sp15:::::::*
	cpe:2.3:a:sap:netweaver_nw04:sp16:::::::*
	cpe:2.3:a:sap:netweaver_nw04:sp17:::::::*
	cpe:2.3:a:sap:netweaver_nw04:sp18:::::::*
	cpe:2.3:a:sap:netweaver_nw04:sp19:::::::*
	cpe:2.3:a:sap:netweaver_nw04s:sp7:::::::*
	cpe:2.3:a:sap:netweaver_nw04s:sp8:::::::*
	cpe:2.3:a:sap:netweaver_nw04s:sp9:::::::*
	cpe:2.3:a:sap:netweaver_nw04s:sp10:::::::*
	cpe:2.3:a:sap:netweaver_nw04s:sp11:::::::*
	cpe:2.3:a:sap:sap_basis_component_640::::::::
	cpe:2.3:a:sap:sap_basis_component_700::::::::

History

No history.

Information

Published : 2007-06-29 18:30

Updated : 2024-02-28 11:01

NVD link : CVE-2007-3496

Mitre link : CVE-2007-3496

CVE.ORG link : CVE-2007-3496

JSON object : View

Products Affected

sap

sap_basis_component_640
netweaver_nw04
sap_basis_component_700
netweaver_nw04s

CWE

NVD-CWE-Other

{"id": "CVE-2007-3496", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2007-06-29T18:30:00.000", "references": [{"url": "http://osvdb.org/37748", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/25866", "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/2850", "source": "cve@mitre.org"}, {"url": "http://www.csnc.ch/advisory/sap01.html", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/472341/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2007/2381", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in SAP Web Dynpro Java (BC-WD-JAV) in SAP NetWeaver Nw04 SP15 through SP19 and Nw04s SP7 through SP11, aka SAP Java Technology Services 640 before SP20 and SAP Web Dynpro Runtime Core Components 700 before SP12, allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header."}, {"lang": "es", "value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en SAP Web Dynpro Java (BC-WD-JAV) en SAP NetWeaver Nw04 SP15 hasta SP19 y Nw04s SP7 hasta SP11, tambi\u00e9n conocido como SAP Java TEchnology Services 640 anterior a SP20 y SAP Web Dynpro Runtime Core Components 700 anterior a SP12, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de la cabecera HTTP User-Agent."}], "lastModified": "2018-10-16T16:50:11.537", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:netweaver_nw04:sp15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9C46819-0988-44E7-9044-F7065DD84A6D"}, {"criteria": "cpe:2.3:a:sap:netweaver_nw04:sp16:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5282330-5991-46EA-ACEF-72B6AB76B547"}, {"criteria": "cpe:2.3:a:sap:netweaver_nw04:sp17:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "761E7AAE-17A9-4E16-8CB4-5C7BFCAFAD39"}, {"criteria": "cpe:2.3:a:sap:netweaver_nw04:sp18:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27BA15F8-5D3C-43E6-9110-50EC8980AAD0"}, {"criteria": "cpe:2.3:a:sap:netweaver_nw04:sp19:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B6D16CA-1FC4-41E3-B6CA-49B1166D9831"}, {"criteria": "cpe:2.3:a:sap:netweaver_nw04s:sp7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87F7D73C-34F9-44D7-A650-AAD8384C095D"}, {"criteria": "cpe:2.3:a:sap:netweaver_nw04s:sp8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F41F99DD-6170-4909-987F-1EDA6610DC75"}, {"criteria": "cpe:2.3:a:sap:netweaver_nw04s:sp9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA366FFE-64AE-4330-8F87-26B258DE360B"}, {"criteria": "cpe:2.3:a:sap:netweaver_nw04s:sp10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F1E7843-FDBB-4145-B7F2-82F3BF1751EA"}, {"criteria": "cpe:2.3:a:sap:netweaver_nw04s:sp11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "232AFD96-D76E-4B26-9EF3-A0E458FDCBF7"}, {"criteria": "cpe:2.3:a:sap:sap_basis_component_640:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6AEEB988-54CE-4E13-AA3B-7C1C73732777", "versionEndIncluding": "sp19"}, {"criteria": "cpe:2.3:a:sap:sap_basis_component_700:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE706CA3-FA62-4706-96E4-5FE0278A3ED3", "versionEndIncluding": "sp11"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}