CVE-2017-11458

Cross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote attackers to inject arbitrary web script or HTML via the sessionID parameter, aka SAP Security Note 2406783.

Score

CVSS 3.1 6.1 Medium

Status

Modified - cve@mitre.org

Published

2017-07-25

Last modified

2024-08-05

Weaknesses

CWE-79

Affected products

• Netweaver Application Server Java (Sap)

References

• http://www.securityfocus.com/bid/97566
• https://erpscan.io/advisories/erpscan-17-017-sap-netweaver-java-7-3-java-xss-ctcprotocolprotocol-servlet/