CVE-2008-1846: XSS
First published: Wed Apr 16 2008(Updated: )
The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" (aka Editor Security or Secure Editing) parameter, which allows remote attackers to conduct cross-site scripting (XSS) attacks by entering feedback for a file.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP NetWeaver | <=7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.aitsec.com/vulnerability-SAP-Netweaver-6.40-7.0-Cross-Site-Scripting.php
- http://www.securityfocus.com/bid/28699
- http://www.securitytracker.com/id?1019822
- http://securityreason.com/securityalert/3812
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41735
- http://www.securityfocus.com/archive/1/490625/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2008-1846?
CVE-2008-1846 is considered a high severity vulnerability due to its potential for remote exploitation through cross-site scripting attacks.
How do I fix CVE-2008-1846?
To fix CVE-2008-1846, ensure that the "Always Use Secure HTML Editor" setting is enabled in the SAP NetWeaver configuration.
What versions of SAP NetWeaver are affected by CVE-2008-1846?
CVE-2008-1846 affects SAP NetWeaver versions prior to 7.0 SP15.
What type of attacks does CVE-2008-1846 allow?
CVE-2008-1846 allows attackers to conduct cross-site scripting (XSS) attacks by exploiting the default configuration settings.
Is there a workaround for CVE-2008-1846?
A temporary workaround for CVE-2008-1846 is to manually sanitize user input before it is rendered in the application.
- agent/softwarecombine
- agent/type
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/sap
- canonical/sap netweaver
- version/sap netweaver/7.0