CVE-2017-11458: XSS

Published Jul 25, 2017

Updated

Cross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote attackers to inject arbitrary web script or HTML via the sessionID parameter, aka SAP Security Note 2406783.

Affected Software

1 affected component

SAP NetWeaver Application Server Java=7.30

Event History

Jul 25, 2017

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2017-11458?

CVE-2017-11458 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.

How does CVE-2017-11458 affect SAP NetWeaver AS JAVA?

CVE-2017-11458 affects SAP NetWeaver AS JAVA 7.3 by allowing remote attackers to inject arbitrary web scripts via the sessionID parameter.

How do I fix CVE-2017-11458?

To fix CVE-2017-11458, apply the patches provided in SAP Security Note 2406783.

Who is affected by CVE-2017-11458?

Organizations using SAP NetWeaver AS JAVA version 7.3 are affected by CVE-2017-11458.

What type of attack can CVE-2017-11458 facilitate?

CVE-2017-11458 can facilitate cross-site scripting (XSS) attacks, allowing the injection of malicious scripts.