Unscored severity · published May 23, 2008
CVE-2008-2421
Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0, Web Dynpro for ABAP (aka WD4A or WDA), and Web Dynpro for BSP allows remote…
–
CVSS
1.8%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0, Web Dynpro for ABAP (aka WD4A or WDA), and Web Dynpro for BSP allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under bc/gui/sap/its/webgui/.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SW
Sap Web Application Server · Sap
7.0 · source: NVD
WD
Web Dynpro · Sap
abap; bsp · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-2421
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-2421
Vendor Advisory
http://secunia.com/advisories/30334
www.securityfocus.com
http://www.securityfocus.com/archive/1/492376/100/0/threaded
Exploit
http://www.securityfocus.com/bid/29317
www.securitytracker.com
http://www.securitytracker.com/id?1020097
www.vupen.com
http://www.vupen.com/english/advisories/2008/1599/references
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/42724
More from Sap Web Application Server
–
CVE-2007-3615
Internet Communication Manager (aka ICMAN.exe or ICM) in SAP NetWeaver Application Server 6.x and 7.x, possibly only on Windows, allows remote attackers to cause a denial of…
–
CVE-2006-6010
SAP allows remote attackers to obtain potentially sensitive information such as operating system and SAP version via an RFC_SYSTEM_INFO RfcCallReceive request, a different…
–
CVE-2006-6011
Unspecified vulnerability in SAP Web Application Server before 6.40 patch 6 allows remote attackers to cause a denial of service (enserver.exe crash) via a certain UDP packet to…
–
CVE-2006-5784
Unspecified vulnerability in enserver.exe in SAP Web Application Server 6.40 before patch 136 and 7.00 before patch 66 allows remote attackers to read arbitrary files via crafted…
–
CVE-2006-5785
Unspecified vulnerability in SAP Web Application Server 6.40 before patch 136 and 7.00 before patch 66 allows remote attackers to cause a denial of service (enserver.exe crash)…