CVE-2017-11458 Cross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote attackers to inject arbitrary web script or HTML via the sessionID parameter, ak...
MediumCVSS 6.1
EPSS 0.97%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote attackers to inject arbitrary web script or HTML via the sessionID parameter, aka SAP Security Note 2406783.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sap netweaver application server java | = 7.30 | No fix listed |
References
- 97566 third-party-advisory vdb-entry
- erpscan.io third-party-advisory