CVE-2009-2932

Cross-site scripting (XSS) vulnerability in uddiclient/process in the UDDI client in SAP NetWeaver Application Server (Java) 7.0 allows remote attackers to inject arbitrary web script or HTML via the TModel Key field.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securitytracker.com/id?1022731
http://www.dsecrg.com/pages/vul/show.php?id=133	Exploit
http://osvdb.org/57000
http://secunia.com/advisories/36228	Vendor Advisory
http://www.securityfocus.com/bid/36034
https://service.sap.com/sap/support/notes/1322098
https://exchange.xforce.ibmcloud.com/vulnerabilities/52429
http://www.securityfocus.com/archive/1/505697/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:netweaver:7.0:*:*:*:*:*:*:*

Information

Published : 2009-08-21 13:30

Updated : 2018-10-10 12:42

NVD link : CVE-2009-2932

Mitre link : CVE-2009-2932

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

sap

netweaver

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securitytracker.com/id?1022731", "name": "1022731", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.dsecrg.com/pages/vul/show.php?id=133", "name": "http://www.dsecrg.com/pages/vul/show.php?id=133", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://osvdb.org/57000", "name": "57000", "tags": [], "refsource": "OSVDB"}, {"url": "http://secunia.com/advisories/36228", "name": "36228", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.securityfocus.com/bid/36034", "name": "36034", "tags": [], "refsource": "BID"}, {"url": "https://service.sap.com/sap/support/notes/1322098", "name": "https://service.sap.com/sap/support/notes/1322098", "tags": [], "refsource": "MISC"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52429", "name": "netweaver-uddi-xss(52429)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/505697/100/0/threaded", "name": "20090812 [DSECRG-09-033] SAP Netweaver UDDI - XSS Security Vulnerability", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in uddiclient/process in the UDDI client in SAP NetWeaver Application Server (Java) 7.0 allows remote attackers to inject arbitrary web script or HTML via the TModel Key field."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2009-2932", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2009-08-21T20:30Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:sap:netweaver:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-10T19:42Z"}