CVE-2009-2932

Cross-site scripting (XSS) vulnerability in uddiclient/process in the UDDI client in SAP NetWeaver Application Server (Java) 7.0 allows remote attackers to inject arbitrary web script or HTML via the TModel Key field.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://osvdb.org/57000
http://secunia.com/advisories/36228	Vendor Advisory
http://www.dsecrg.com/pages/vul/show.php?id=133	Exploit
http://www.securityfocus.com/archive/1/505697/100/0/threaded
http://www.securityfocus.com/bid/36034
http://www.securitytracker.com/id?1022731
https://exchange.xforce.ibmcloud.com/vulnerabilities/52429
https://service.sap.com/sap/support/notes/1322098

Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:netweaver:7.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2009-08-21 20:30

Updated : 2024-02-04 17:33

NVD link : CVE-2009-2932

Mitre link : CVE-2009-2932

CVE.ORG link : CVE-2009-2932

JSON object : View

Products Affected

sap

netweaver

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2009-2932", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2009-08-21T20:30:00.407", "references": [{"url": "http://osvdb.org/57000", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/36228", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.dsecrg.com/pages/vul/show.php?id=133", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/505697/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/36034", "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id?1022731", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52429", "source": "cve@mitre.org"}, {"url": "https://service.sap.com/sap/support/notes/1322098", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in uddiclient/process in the UDDI client in SAP NetWeaver Application Server (Java) 7.0 allows remote attackers to inject arbitrary web script or HTML via the TModel Key field."}, {"lang": "es", "value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en uddiclient/process en el cliente UDDI en SAP NetWeaver Application Server (Java) 7.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n mediante el campo TModel Key."}], "lastModified": "2018-10-10T19:42:45.500", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:netweaver:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "41FAC5DD-D577-47F9-B0CA-006032256642"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}