CVE-2016-6858: XSS
Cross-site scripting (XSS) vulnerability in the Create Employee feature in Hybris Management Console (HMC) in SAP Hybris before 5.0.4.11, 5.1.0.x before 5.1.0.11, 5.1.1.x before 5.1.1.12, 5.2.0.x and 5.3.0.x before 5.3.0.10, 5.4.x before 5.4.0.9, 5.5.0.x before 5.5.0.9, 5.5.1.x before 5.5.1.10, 5.6.x before 5.6.0.8, and 5.7.x before 5.7.0.9 allows remote authenticated users to inject arbitrary web script or HTML via the Name field.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6858?
CVE-2016-6858 is classified as a moderate severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2016-6858?
To fix CVE-2016-6858, upgrade your SAP Hybris installation to versions 5.0.4.11, 5.1.0.11, 5.1.1.12, 5.2.0.10, 5.3.0.10, 5.4.0.9, 5.5.0.9, 5.5.1.10 or later.
Which versions of SAP Hybris are affected by CVE-2016-6858?
CVE-2016-6858 affects multiple versions of SAP Hybris prior to 5.0.4.11, 5.1.0.11, 5.1.1.12, 5.2.0.10, 5.3.0.10, 5.4.0.9, 5.5.0.9, and 5.5.1.10.
What type of vulnerability is CVE-2016-6858?
CVE-2016-6858 is a cross-site scripting (XSS) vulnerability specifically in the Create Employee feature of the Hybris Management Console.
Can CVE-2016-6858 allow unauthorized actions?
Yes, CVE-2016-6858 could potentially allow attackers to execute unauthorized scripts in the user's browser, leading to various malicious actions.