Author: Positive Technologies / Source: Information Security Buzz
Users of SAP NetWeaver 7.31 advised to install security updates
Positive Technologies has today confirmed it has detected vulnerabilities in SAP Enterprise Portal Navigation, SAP NetWeaver Log Viewer and SAP Enterprise Portal Theme Editor, which are the components of the SAP NetWeaver platform. By exploiting these security flaws, attackers can intercept login credentials, register keystrokes, spoof data or perform other illegal activities that could potentially lead to a system compromise.
Four Cross-Site Scripting (XSS) vulnerabilities were detected in the following SAP Enterprise Portal components: SAP Enterprise Portal Navigation (CVSSv3 score 6.1) and SAP Enterprise Portal Theme Editor (three flaws with CVSSv3 scores 5.4, 6.1, and 6.1).
Exploiting these vulnerabilities, an attacker could obtain access to a victim’s session tokens, login credentials or other sensitive information in the browser, perform arbitrary actions on the victim’s behalf, rewrite HTML page content and intercept keystrokes. The relevant remediation guidelines are described in SAP Security notes No. 2369469, 2372183, 2372204, and 2377626.
Another vulnerability—Directory Traversal (CVSSv3 score 5.9)—allows arbitrary file upload in SAP NetWeaver Log Viewer. Attackers…
Click here to read more
