CVE-2010-2904: XSS
Published Jul 28, 2010
·Updated
Multiple cross-site scripting (XSS) vulnerabilities in the System Landscape Directory (SLD) component 6.4 through 7.02 in SAP NetWeaver allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter to testsdic and the (2) helpstring parameter to paramhelp.jsp.
Affected Software
6 affected components
SAP System Landscape Directory=6.4
SAP System Landscape Directory=7.0
SAP System Landscape Directory=7.02
SAP NetWeaver
SAP NetWeaver=6.4
SAP NetWeaver=7.0
Event History
Jul 28, 2010
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Data Sourced
09:30 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What are the risks associated with CVE-2010-2904?
CVE-2010-2904 allows attackers to execute arbitrary web scripts or HTML, leading to potential data theft and account compromise.
2
What versions of SAP NetWeaver are affected by CVE-2010-2904?
CVE-2010-2904 affects SAP NetWeaver versions 6.4, 7.0, and 7.02.
3
How can I mitigate the effects of CVE-2010-2904?
To mitigate CVE-2010-2904, users should update to the latest patched version of SAP NetWeaver.
4
What components are involved in CVE-2010-2904?
CVE-2010-2904 involves the System Landscape Directory (SLD) component of SAP NetWeaver.
5
What type of vulnerability is CVE-2010-2904 classified as?
CVE-2010-2904 is classified as a cross-site scripting (XSS) vulnerability.