NVD Vulnerability Detail

CVE-2016-1911

Summary	Multiple cross-site scripting (XSS) vulnerabilities in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) Runtime Workbench (RWB) or (2) Pmitest servlet in the Process Monitoring Infrastructure (PMI), aka SAP Security Notes 2206793 and 2234918.
Publication Date	Jan. 16, 2016, 5:59 a.m.
Registration Date	Jan. 26, 2021, 2:08 p.m.
Last Update	Nov. 21, 2024, 11:47 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:sap:netweaver:7.40:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	http://seclists.org/fulldisclosure/2016/Apr/58
2	http://seclists.org/fulldisclosure/2016/Apr/58
3	http://seclists.org/fulldisclosure/2016/Apr/64
4	http://seclists.org/fulldisclosure/2016/Apr/64
5	https://erpscan.io/advisories/erpscan-16-001-xss-sap-netweaver-7-4-mdt-servlet/
6	https://erpscan.io/advisories/erpscan-16-001-xss-sap-netweaver-7-4-mdt-servlet/
7	https://erpscan.io/advisories/erpscan-16-004-sap-netweaver-7-4-pmitest-servlet-xss/
8	https://erpscan.io/advisories/erpscan-16-004-sap-netweaver-7-4-pmitest-servlet-xss/
9	https://erpscan.io/press-center/blog/sap-security-notes-january-2016-review/
10	https://erpscan.io/press-center/blog/sap-security-notes-january-2016-review/

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

JVN Vulnerability Information

SAP NetWeaver におけるクロスサイトスクリプティングの脆弱性

Title	SAP NetWeaver におけるクロスサイトスクリプティングの脆弱性
Summary	SAP NetWeaver には、クロスサイトスクリプティングの脆弱性が存在します。ベンダは、本脆弱性を SAP Security Note 2206793 および 2234918 として公開しています。
Possible impacts	第三者により、任意の Web スクリプトまたは HTML を挿入される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 12, 2016, midnight
Registration Date	Jan. 21, 2016, 4:04 p.m.
Last Update	Jan. 21, 2016, 4:04 p.m.

Affected System

SAP

SAP NetWeaver 7.4

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-1911	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1911
2	CVE-2016-1911	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1911
National Vulnerability Database (NVD)
3	CVE-2016-1911	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1911
4	CVE-2016-1911	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1911

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html
2	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
SAP
1	SAP Security Notes January 2016 - Review (2206793/2234918)	http://scn.sap.com/community/security/blog/2016/01/12/sap-security-notes-january-2016-review
2	SAP Security Notes January 2016 - Review (2206793/2234918)	http://scn.sap.com/community/security/blog/2016/01/12/sap-security-notes-january-2016-review

その他

No	Name	URL
関連文書
1	[ERPSCAN-16-001] SAP NetWeaver 7.4 (MDT component) - XSS vulnerabilitylity	http://erpscan.com/advisories/erpscan-16-001-xss-sap-netweaver-7-4-mdt-servlet/
2	[ERPSCAN-16-001] SAP NetWeaver 7.4 (MDT component) - XSS vulnerabilitylity	http://erpscan.com/advisories/erpscan-16-001-xss-sap-netweaver-7-4-mdt-servlet/
3	[ERPSCAN-16-004] SAP NetWeaver 7.4 (Pmitest servlet) - XSS vulnerability	http://erpscan.com/advisories/erpscan-16-004-sap-netweaver-7-4-pmitest-servlet-xss/
4	[ERPSCAN-16-004] SAP NetWeaver 7.4 (Pmitest servlet) - XSS vulnerability	http://erpscan.com/advisories/erpscan-16-004-sap-netweaver-7-4-pmitest-servlet-xss/

Change Log

No	Changed Details	Date of change
0	[2016年01月21日] 掲載	Feb. 17, 2018, 10:37 a.m.
0	[2016年01月21日] 掲載	Feb. 17, 2018, 10:37 a.m.