CVE-2008-1846

The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" (aka Editor Security or Secure Editing) parameter, which allows remote attackers to conduct cross-site scripting (XSS) attacks by entering feedback for a file.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 65%
VendorProductVersion
sapnetweaver
𝑥
≤ 7.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://securityreason.com/securityalert/3812
http://www.aitsec.com/vulnerability-SAP-Netweaver-6.40-7.0-Cross-Site-Scripting.php
http://www.securityfocus.com/archive/1/490625/100/0/threaded
http://www.securityfocus.com/bid/28699
http://www.securitytracker.com/id?1019822
https://exchange.xforce.ibmcloud.com/vulnerabilities/41735
http://securityreason.com/securityalert/3812
http://www.aitsec.com/vulnerability-SAP-Netweaver-6.40-7.0-Cross-Site-Scripting.php
http://www.securityfocus.com/archive/1/490625/100/0/threaded
http://www.securityfocus.com/bid/28699
http://www.securitytracker.com/id?1019822
https://exchange.xforce.ibmcloud.com/vulnerabilities/41735