Sign-up

ID

VAR-200901-0456


CVE

CVE-2008-3358


TITLE

SAP NetWeaver Portal Web Dynpro (WD) Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2009-001639

DESCRIPTION

Cross-site scripting (XSS) vulnerability in Web Dynpro (WD) in the SAP NetWeaver portal, when Internet Explorer 7.0.5730 is used, allows remote attackers to inject arbitrary web script or HTML via a crafted URI, which causes the XSS payload to be reflected in a text/plain document. SAP NetWeaver and Web Dynpro Java are prone to a cross-site scripting vulnerability because the applications fail to sufficiently sanitize user-supplied input. A successful exploit of this vulnerability could allow an attacker to compromise the application, access or modify data, or steal cookie-based authentication credentials. Other attacks are also possible. This issue is associated with SAP notification number 1235253. ############################################################# # # COMPASS SECURITY ADVISORY # http://www.csnc.ch/en/downloads/advisories.html # ############################################################# # # Product: NetWeaver/Web DynPro # Vendor: SAP (www.sap.com) # CVD ID: CVE-2008-3358 # Subject: Cross-Site Scripting Vulnerability # Risk: High # Effect: Remotely exploitable # Author: Martin Suess <martin.suess@csnc.ch> # Date: January 27th 2009 # ############################################################# Introduction: ------------- The vulnerability found targets the SAP NetWeaver portal. It is possible to execute JavaScript code in the browser of a valid user when clicking on a specially crafted URL which can be sent to the user by email. This vulnerability can be used to steal the user's session cookie or redirect him to a phishing website which shows the (faked) login screen and gets his logon credentials as soon as he tries to log in on the faked site. Affected: --------- - All tested versions that are vulnerable SAP NetWeaver/Web DynPro [for detailed Information, see SAP Notification 1235253] Description: ------------ A specially crafted URL in SAP NetWeaver allows an attacker to launch a Cross-Site Scripting attack. The resulting page contains only the unfiltered value of the vulnerable parameter. It is possible to create an URL which causes the resulting page to contain malicious JavaScript code. A response to such a request could look like the following example: HTTP/1.1 200 OK Date: Fri, 18 Jul 2008 13:13:30 GMT Server: <server> content-type: text/plain Content-Length: 67 Keep-Alive: timeout=10, max=500 Connection: Keep-Alive <html><title>test</title><body onload="alert(document.cookie)"> </body></html> The code only gets executed in Microsoft Internet Explorer (tested with version 7.0.5730 only). In Firefox (tested with version 3.0 only) it did not get executed as the content-type header of the server response is interpreted more strictly (text/plain). SAP Information Policy: ----------------------- The information is available to registered SAP clients only (SAP Security Notes). Patches: -------- Apply the latest SAP security patches for Netweaver. Timeline: --------- Vendor Status: Patch released Vendor Notified: July 21st 2008 Vendor Response: July 28th 2008 Patch available: October 2008 Advisory Release: January 27th 2009 References: ----------- - SAP Notification 1235253 (problem and patches) . ---------------------------------------------------------------------- Did you know that a change in our assessment rating, exploit code availability, or if an updated patch is released by the vendor, is not part of this mailing-list? Click here to learn more: http://secunia.com/advisories/business_solutions/ ---------------------------------------------------------------------- TITLE: SAP NetWeaver Cross-Site Scripting Vulnerability SECUNIA ADVISORY ID: SA33685 VERIFY ADVISORY: http://secunia.com/advisories/33685/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: >From remote SOFTWARE: SAP NetWeaver 4.x http://secunia.com/advisories/product/9490/ DESCRIPTION: A vulnerability has been reported in SAP NetWeaver, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed via the URL is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Successful exploitation may require that the victim uses a browser which executes JavaScript statements in documents of the content type "text/plain" (e.g. Internet Explorer). SOLUTION: The vendor has reportedly issued a patch via SAP Note 1235253. http://service.sap.com/sap/support/notes/1235253 PROVIDED AND/OR DISCOVERED BY: Martin Suess, Compass Security ORIGINAL ADVISORY: SAP: http://service.sap.com/sap/support/notes/1235253 Compass Security: http://www.csnc.ch/misc/files/advisories/CVE-2008-3358.txt ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2008-3358 // JVNDB: JVNDB-2009-001639 // BID: 33465 // PACKETSTORM: 74357 // PACKETSTORM: 74348

AFFECTED PRODUCTS

vendor:sapmodel:netweaverscope: - version: -

Trust: 1.4

vendor:sapmodel:netweaverscope:eqversion:*

Trust: 1.0

vendor:sapmodel:netweaver application server sp21scope:eqversion:6.40104329.313

Trust: 0.3

vendor:sapmodel:netweaver application server sp17scope:eqversion:6.40104329.313

Trust: 0.3

vendor:sapmodel:netweaver nw04s sp9scope: - version: -

Trust: 0.3

vendor:sapmodel:netweaver portal sp21scope:eqversion:2004

Trust: 0.3

vendor:sapmodel:netweaver application server sp17scope:eqversion:6.40

Trust: 0.3

vendor:sapmodel:netweaver nw04 sp17scope: - version: -

Trust: 0.3

vendor:sapmodel:netweaver nw04 sp15scope: - version: -

Trust: 0.3

vendor:sapmodel:netweaver portalscope:eqversion:2004..

Trust: 0.3

vendor:sapmodel:netweaver sp15scope:eqversion:7.0

Trust: 0.3

vendor:sapmodel:netweaver nw04s sp10scope: - version: -

Trust: 0.3

vendor:sapmodel:netweaver sp20scope:eqversion:640

Trust: 0.3

vendor:sapmodel:netweaver nw04s sp8scope: - version: -

Trust: 0.3

vendor:sapmodel:netweaver nw04s sp11scope: - version: -

Trust: 0.3

vendor:sapmodel:netweaver developer studio sp21scope:eqversion:2004

Trust: 0.3

vendor:sapmodel:netweaver nw04s sp7scope: - version: -

Trust: 0.3

vendor:sapmodel:web dynpro runtime core components sp12scope:eqversion:700

Trust: 0.3

vendor:sapmodel:netweaver nw04 sp18scope: - version: -

Trust: 0.3

vendor:sapmodel:netweaver nw04 sp19scope: - version: -

Trust: 0.3

vendor:sapmodel:netweaver sp8scope:eqversion:7.0

Trust: 0.3

vendor:sapmodel:netweaver nw04 sp16scope: - version: -

Trust: 0.3

vendor:sapmodel:netweaver portal sp17scope:eqversion:2004

Trust: 0.3

vendor:sapmodel:netweaver developer studio sp17scope:eqversion:-2004

Trust: 0.3

sources: BID: 33465 // JVNDB: JVNDB-2009-001639 // CNNVD: CNNVD-200901-384 // NVD: CVE-2008-3358

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2008-3358
value: MEDIUM

Trust: 1.0

NVD: CVE-2008-3358
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-200901-384
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2008-3358
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

sources: JVNDB: JVNDB-2009-001639 // CNNVD: CNNVD-200901-384 // NVD: CVE-2008-3358

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.8

sources: JVNDB: JVNDB-2009-001639 // NVD: CVE-2008-3358

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200901-384

TYPE

xss

Trust: 0.8

sources: PACKETSTORM: 74357 // PACKETSTORM: 74348 // CNNVD: CNNVD-200901-384

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2009-001639

PATCH
title:Top Pageurl:https://websmp206.sap-ag.de/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2009-001639

EXTERNAL IDS
db:NVDid:CVE-2008-3358
Trust: 2.9
db:BIDid:33465
Trust: 1.9
db:SECUNIAid:33685
Trust: 1.8
db:VUPENid:ADV-2009-0255
Trust: 1.6
db:SECTRACKid:1021638
Trust: 1.6
db:OSVDBid:51627
Trust: 1.6
db:JVNDBid:JVNDB-2009-001639
Trust: 0.8
db:BUGTRAQid:20090127 SAP NETWEAVER XSS VULNERABILITY
Trust: 0.6
db:XFid:48237
Trust: 0.6
db:CNNVDid:CNNVD-200901-384
Trust: 0.6
db:PACKETSTORMid:74357
Trust: 0.1
db:PACKETSTORMid:74348
Trust: 0.1
sources:
            
            
            BID: 33465 // 
            
            
            
            JVNDB: JVNDB-2009-001639 // 
            
            
            
            PACKETSTORM: 74357 // 
            
            
            
            PACKETSTORM: 74348 // 
            
            
            
            CNNVD: CNNVD-200901-384 // 
            
            
            
            NVD: CVE-2008-3358

REFERENCES
url:http://www.csnc.ch/misc/files/advisories/cve-2008-3358.txt
Trust: 1.7
url:http://service.sap.com/sap/support/notes/1235253
Trust: 1.7
url:http://www.securitytracker.com/id?1021638
Trust: 1.6
url:http://www.securityfocus.com/bid/33465
Trust: 1.6
url:http://secunia.com/advisories/33685
Trust: 1.6
url:http://osvdb.org/51627
Trust: 1.6
url:http://www.securityfocus.com/archive/1/500415/100/0/threaded
Trust: 1.0
url:http://www.vupen.com/english/advisories/2009/0255
Trust: 1.0
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/48237
Trust: 1.0
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-3358
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-3358
Trust: 0.8
url:http://xforce.iss.net/xforce/xfdb/48237
Trust: 0.6
url:http://www.securityfocus.com/archive/1/archive/1/500415/100/0/threaded
Trust: 0.6
url:http://www.frsirt.com/english/advisories/2009/0255
Trust: 0.6
url:http://www.sap.com/platform/netweaver/index.epx
Trust: 0.3
url:https://www.sdn.sap.com/irj/sdn/webdynpro
Trust: 0.3
url:/archive/1/500415
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2008-3358
Trust: 0.1
url:https://www.sap.com)
Trust: 0.1
url:http://www.csnc.ch/en/downloads/advisories.html
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/advisories/product/9490/
Trust: 0.1
url:http://secunia.com/advisories/business_solutions/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/advisories/33685/
Trust: 0.1
sources:
            
            
            BID: 33465 // 
            
            
            
            JVNDB: JVNDB-2009-001639 // 
            
            
            
            PACKETSTORM: 74357 // 
            
            
            
            PACKETSTORM: 74348 // 
            
            
            
            CNNVD: CNNVD-200901-384 // 
            
            
            
            NVD: CVE-2008-3358

CREDITS
Martin Suess
Trust: 0.4
sources:
            
            
            BID: 33465 // 
            
            
            
            PACKETSTORM: 74357

SOURCES
db:BIDid:33465
db:JVNDBid:JVNDB-2009-001639
db:PACKETSTORMid:74357
db:PACKETSTORMid:74348
db:CNNVDid:CNNVD-200901-384
db:NVDid:CVE-2008-3358

LAST UPDATE DATE
2024-11-23T23:00:07.564000+00:00

SOURCES UPDATE DATE
db:BIDid:33465date:2009-01-27T20:39:00
db:JVNDBid:JVNDB-2009-001639date:2009-07-08T00:00:00
db:CNNVDid:CNNVD-200901-384date:2009-02-05T00:00:00
db:NVDid:CVE-2008-3358date:2024-11-21T00:49:03.553

SOURCES RELEASE DATE
db:BIDid:33465date:2009-01-27T00:00:00
db:JVNDBid:JVNDB-2009-001639date:2009-07-08T00:00:00
db:PACKETSTORMid:74357date:2009-01-27T23:35:23
db:PACKETSTORMid:74348date:2009-01-27T15:25:01
db:CNNVDid:CNNVD-200901-384date:2009-01-28T00:00:00
db:NVDid:CVE-2008-3358date:2009-01-28T18:30:00.170