CVE-2016-6857: XSS
Cross-site scripting (XSS) vulnerability in the Create Catalogue feature in Hybris Management Console (HMC) in SAP Hybris before 5.2.0.13, 5.3.x before 5.3.0.11, 5.4.x before 5.4.0.11, 5.5.0.x before 5.5.0.10, 5.5.1.x before 5.5.1.11, 5.6.x before 5.6.0.11, and 5.7.x before 5.7.0.15 allows remote authenticated users to inject arbitrary web script or HTML via the ID field.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6857?
CVE-2016-6857 is classified as a medium severity vulnerability due to its potential for exploitation via cross-site scripting.
How do I fix CVE-2016-6857?
To remediate CVE-2016-6857, upgrade your SAP Hybris software to the version 5.2.0.13 or later, or any of the other specified patched versions.
What types of systems are affected by CVE-2016-6857?
CVE-2016-6857 affects various versions of SAP Hybris Management Console (HMC) prior to specified security patches.
Can CVE-2016-6857 be exploited remotely?
Yes, CVE-2016-6857 allows remote attackers to exploit the cross-site scripting vulnerability through crafted input.
Do I need to apply multiple updates for CVE-2016-6857?
Depending on your current version of SAP Hybris, you may need to apply a single update to the latest version or sequentially update to the mentioned patched versions.