Unscored severity · published Aug 21, 2009
CVE-2009-2932
Cross-site scripting (XSS) vulnerability in uddiclient/process in the UDDI client in SAP NetWeaver Application Server (Java) 7.0 allows remote attackers to inject arbitrary web…
–
CVSS
2.1%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in uddiclient/process in the UDDI client in SAP NetWeaver Application Server (Java) 7.0 allows remote attackers to inject arbitrary web script or HTML via the TModel Key field.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Netweaver · Sap
7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2932
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2932
osvdb.org
http://osvdb.org/57000
Vendor Advisory
http://secunia.com/advisories/36228
Exploit
http://www.dsecrg.com/pages/vul/show.php?id=133
www.securityfocus.com
http://www.securityfocus.com/archive/1/505697/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/36034
www.securitytracker.com
http://www.securitytracker.com/id?1022731
More from Netweaver
10.0
CVE-2020-6287
SAP NetWeaver Missing Authentication for Critical Function Vulnerability
10.0
CVE-2010-5326
SAP NetWeaver Remote Code Execution Vulnerability
9.8
CVE-2025-31324
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
9.8
CVE-2016-2386
SAP NetWeaver SQL Injection Vulnerability
9.1
CVE-2025-42999
Insecure Deserialization in SAP NetWeaver (Visual Composer development server)