CVE-2016-2387: XSS
Multiple cross-site scripting (XSS) vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) ns or (2) interface parameter to ProxyServer/register, aka SAP Security Note 2220571.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2387?
CVE-2016-2387 is considered a medium severity vulnerability due to potential for exploitation via cross-site scripting.
How can I fix CVE-2016-2387?
To address CVE-2016-2387, ensure you apply the relevant security patches provided by SAP as described in SAP Security Note 2220571.
Who is affected by CVE-2016-2387?
CVE-2016-2387 affects the SAP NetWeaver version 7.40.
What type of attacks can CVE-2016-2387 facilitate?
CVE-2016-2387 can facilitate cross-site scripting attacks, allowing attackers to inject arbitrary web scripts or HTML.
Is user input validation sufficient to mitigate CVE-2016-2387?
No, simply validating user input is not sufficient; applying the necessary security patches is critical for mitigation.