CVE-2008-1846: XSS
The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" (aka Editor Security or Secure Editing) parameter, which allows remote attackers to conduct cross-site scripting (XSS) attacks by entering feedback for a file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-1846?
CVE-2008-1846 is considered a high severity vulnerability due to its potential for remote exploitation through cross-site scripting attacks.
How do I fix CVE-2008-1846?
To fix CVE-2008-1846, ensure that the "Always Use Secure HTML Editor" setting is enabled in the SAP NetWeaver configuration.
What versions of SAP NetWeaver are affected by CVE-2008-1846?
CVE-2008-1846 affects SAP NetWeaver versions prior to 7.0 SP15.
What type of attacks does CVE-2008-1846 allow?
CVE-2008-1846 allows attackers to conduct cross-site scripting (XSS) attacks by exploiting the default configuration settings.
Is there a workaround for CVE-2008-1846?
A temporary workaround for CVE-2008-1846 is to manually sanitize user input before it is rendered in the application.