SAP Netweaver Multiple Vulnerabilities

Bugtraq ID:	48718
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Jul 19 2011 12:00AM
Updated:	Jul 19 2011 12:00AM
Credit:	Alexander Polyakov, Dmitriy Evdokimov, and Alexey Sintsov from DSecRG
Vulnerable:	SAP NetWeaver 7.30 SAP NetWeaver 7.10 SAP NetWeaver 7.02 SAP NetWeaver 7.01 SAP NetWeaver 7.0 SP8 SAP NetWeaver 7.0 SP15 SAP NetWeaver 7.0
Not Vulnerable:

SAP Netweaver Multiple Vulnerabilities

SAP Netweaver is prone to cross-site scripting, information-disclosure, and denial-of-service vulnerabilities.

An attacker may leverage the issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, disclose sensitive information, or cause denial-of-service conditions.

SAP Netweaver Multiple Vulnerabilities

An attacker can use a Web browser to exploit these issues. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI.

SAP Netweaver Multiple Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

SAP Netweaver Multiple Vulnerabilities

References:

• [DSECRG-11-027] NetWeaver BCB �?? Missing Authorization / Information disclosure (Digital Security Research Group)
  
• [DSECRG-11-028] SAP NetWeaver ISpeak �?? XSS (Digital Security Research Group)
  
• [DSECRG-11-029] SAP NetWeaver SOAP RFC �?? Denial of Service / Integer overflow (Digital Security Research Group)
  
• SAP NetWeaver Homepage (SAP)