[ERPSCAN-16-001] SAP NetWeaver 7.4 - XSS vulnerability
ERPScan inc <[email protected]> Fri, 15 Apr 2016 17:18:02 +0300
| Newsgroups | gmane.comp.security.fulldisclosure,gmane.comp.security.penetration,gmane.comp.security.news.securitytracker,gmane.comp.security.bugtraq |
|---|---|
| Message-ID | <CANHWe92HGRO5WDNC=qp4S=3fJg2jgFOTsMv2vUWR0z+kHQoWZQ@mail.gmail.com> |
QXBwbGljYXRpb246U0FQIE5ldFdlYXZlcgpWZXJzaW9ucyBBZmZlY3RlZDogU0FQIE5ldFdlYXZl ciBKMkVFIEVuZ2luZSA3LjQwClZlbmRvciBVUkw6IGh0dHA6Ly9TQVAuY29tCkJ1Z3M6IENyb3Nz LVNpdGUgU2NyaXB0aW5nClNlbnQ6ICAwMS4wOS4yMDE1ClZlbmRvciByZXNwb25zZTogMDIuMDku MjAxNQpEYXRlIG9mIFB1YmxpYyBBZHZpc29yeTogMTIuMDEuMjAxNgpSZWZlcmVuY2U6IFNBUCBT ZWN1cml0eSBOb3RlIDIyMDY3OTMKQXV0aG9yOiAgVmFoYWduIFZhcmRhbnlhbiAoRVJQU2NhbikK CgoKRGVzY3JpcHRpb24KCgoxLiBBRFZJU09SWSBJTkZPUk1BVElPTgpUaXRsZTogU0FQIE5ldFdl YXZlciBKMkVFIEVuZ2luZSA3LjQwCkFkdmlzb3J5IElEOiBbRVJQU0NBTi0xNi0wMDFdClJpc2s6 IEhpZ2h0CkFkdmlzb3J5IFVSTDogaHR0cDovL2VycHNjYW4uY29tL2Fkdmlzb3JpZXMvZXJwc2Nh bi0xNi0wMDEteHNzLXNhcC1uZXR3ZWF2ZXItNy00LW1kdC1zZXJ2bGV0LwpEYXRlIHB1Ymxpc2hl ZDogMTIuMDEuMjAxNgpWZW5kb3JzIGNvbnRhY3RlZDogU0FQCgoyLiBWVUxORVJBQklMSVRZIElO Rk9STUFUSU9OCkNsYXNzOiBDcm9zcy1TaXRlIFNjcmlwdGluZywgWFNTIFtDV0UtNzldCkltcGFj dDogaW5mb3JtYXRpb24gZGlzY2xvc3VyZSwgc3RpbGwgYW50aS1TQ1JGIHRva2VucwpSZW1vdGVs eSBFeHBsb2l0YWJsZTogWWVzCkxvY2FsbHkgRXhwbG9pdGFibGU6IE5vCgpDVlNTIEluZm9ybWF0 aW9uCkNWU1MgQmFzZSBTY29yZTogIDQuMyAvIDEwCkNWU1MgQmFzZSBWZWN0b3I6CkFWIDogQWNj ZXNzIFZlY3RvciAoUmVsYXRlZCBleHBsb2l0IHJhbmdlKQogIE5ldHdvcmsgKE4pCkFDIDogQWNj ZXNzIENvbXBsZXhpdHkgKFJlcXVpcmVkIGF0dGFjayBjb21wbGV4aXR5KSAgICAgICAgICAgICAg TWVkaXVtIChNKQpBdSA6IEF1dGhlbnRpY2F0aW9uIChMZXZlbCBvZiBhdXRoZW50aWNhdGlvbiBu ZWVkZWQgdG8gZXhwbG9pdCkgTm9uZSAoTikKQyA6IEltcGFjdCB0byBDb25maWRlbnRpYWxpdHkK ICAgICAgICAgICAgIE5vbmUgKE4pCkkgIDogSW1wYWN0IHRvIEludGVncml0eQogICAgICAgICAg ICAgICAgICBQYXJ0aWFsIChQKQpBIDogSW1wYWN0IHRvIEF2YWlsYWJpbGl0eQogICAgICAgICAg ICAgIE5vbmUgKE4pCgoKCjMuIFZVTE5FUkFCSUxJVFkgREVTQ1JJUFRJT04KCkFub255bW91cyBh dHRhY2tlciBjYW4gdXNlIGEgc3BlY2lhbCBIVFRQIHJlcXVlc3QgdG8gaGlqYWNrIHNlc3Npb24K ZGF0YSBvZiBhZG1pbmlzdHJhdG9ycyBvciB1c2VycyBvZiB0aGUgd2ViIHJlc291cmNlLgoKCjQu IFZVTE5FUkFCTEUgUEFDS0FHRVMKClNBUCBOZXRXZWF2ZXIgSjJFRSBFbmdpbmUgNy40MApPdGhl ciB2ZXJzaW9ucyBhcmUgcHJvYmFibHkgYWZmZWN0ZWQgdG9vLCBidXQgdGhleSB3ZXJlIG5vdCBj aGVja2VkLgoKNS4gU09MVVRJT05TIEFORCBXT1JLQVJPVU5EUwoKVG8gY29ycmVjdCB0aGlzIHZ1 bG5lcmFiaWxpdHksIGluc3RhbGwgU0FQIFNlY3VyaXR5IE5vdGUgMjIwNjc5MwoKCjYuIEFVVEhP UgoKVmFoYWduIFZhcmRhbnlhbiAoRVJQU2NhbikKCgo3LiBURUNITklDQUwgREVTQ1JJUFRJT04K ClJXQiBjYW4gYmUgYWJ1c2VkIGJ5IGF0dGFja2VycyBhbGxvd2luZyB0aGVtIHRvIG1vZGlmeSBk aXNwbGF5ZWQKYXBwbGljYXRpb24gY29udGVudCB3aXRob3V0IGF1dGhvcml6YXRpb24gYW5kIHRv IHBvdGVudGlhbGx5IG9idGFpbgphdXRoZW50aWNhdGlvbiBpbmZvcm1hdGlvbiBmcm9tIG90aGVy IGxlZ2l0aW1hdGUgdXNlcnMuCgoKOC4gUkVQT1JUIFRJTUVMSU5FCgpTZW50OiAgIDAxLjA5LjIw MTUKUmVwb3J0ZWQ6IDAxLjA5LjIwMTUKVmVuZG9yIHJlc3BvbnNlOiAwMi4wOS4yMDE1CkRhdGUg b2YgUHVibGljIEFkdmlzb3J5OiAxMi4wMS4yMDE2CgoKOS4gUkVGRVJFTkNFUwoKaHR0cDovL2Vy cHNjYW4uY29tL2Fkdmlzb3JpZXMvZXJwc2Nhbi0xNi0wMDEteHNzLXNhcC1uZXR3ZWF2ZXItNy00 LW1kdC1zZXJ2bGV0LwoKMTAuIEFCT1VUIEVSUFNjYW4gUmVzZWFyY2gKClRoZSBjb21wYW554oCZ cyBleHBlcnRpc2UgaXMgYmFzZWQgb24gdGhlIHJlc2VhcmNoIHN1YmRpdmlzaW9uIG9mCkVSUFNj YW4sIHdoaWNoIGlzIGVuZ2FnZWQgaW4gdnVsbmVyYWJpbGl0eSByZXNlYXJjaCBhbmQgYW5hbHlz aXMgb2YKY3JpdGljYWwgZW50ZXJwcmlzZSBhcHBsaWNhdGlvbnMuIEl0IGhhcyBhY2hpZXZlZCBt dWx0aXBsZQphY2tub3dsZWRnbWVudHMgZnJvbSB0aGUgbGFyZ2VzdCBzb2Z0d2FyZSB2ZW5kb3Jz IGxpa2UgU0FQLCBPcmFjbGUsCk1pY3Jvc29mdCwgSUJNLCBWTXdhcmUsIEhQIGZvciBkaXNjb3Zl cmluZyBtb3JlIHRoYW4gNDAwCnZ1bG5lcmFiaWxpdGllcyBpbiB0aGVpciBzb2x1dGlvbnMgKDIw MCBvZiB0aGVtIGp1c3QgaW4gU0FQISkuCkVSUFNjYW4gcmVzZWFyY2hlcnMgYXJlIHByb3VkIHRv IGhhdmUgZXhwb3NlZCBuZXcgdHlwZXMgb2YKdnVsbmVyYWJpbGl0aWVzIChUT1AgMTAgV2ViIEhh Y2tpbmcgVGVjaG5pcXVlcyAyMDEyKSBhbmQgdG8gYmUKbm9taW5hdGVkIGZvciB0aGUgYmVzdCBz ZXJ2ZXItc2lkZSB2dWxuZXJhYmlsaXR5IGF0IEJsYWNrSGF0IDIwMTMuCkVSUFNjYW4gZXhwZXJ0 cyBoYXZlIGJlZW4gaW52aXRlZCB0byBzcGVhaywgcHJlc2VudCwgYW5kIHRyYWluIGF0IDYwKwpw cmltZSBpbnRlcm5hdGlvbmFsIHNlY3VyaXR5IGNvbmZlcmVuY2VzIGluIDI1KyBjb3VudHJpZXMg YWNyb3NzIHRoZQpjb250aW5lbnRzLiBUaGVzZSBpbmNsdWRlIEJsYWNrSGF0LCBSU0EsIEhJVEIs IGFuZCBwcml2YXRlIFNBUAp0cmFpbmluZ3MgaW4gc2V2ZXJhbCBGb3J0dW5lIDIwMDAgY29tcGFu aWVzLgpFUlBTY2FuIHJlc2VhcmNoZXJzIGxlYWQgdGhlIHByb2plY3QgRUFTLVNFQywgd2hpY2gg aXMgZm9jdXNlZCBvbgplbnRlcnByaXNlIGFwcGxpY2F0aW9uIHNlY3VyaXR5IHJlc2VhcmNoIGFu ZCBhd2FyZW5lc3MuIFRoZXkgaGF2ZQpwdWJsaXNoZWQgMyBleGhhdXN0aXZlIGFubnVhbCBhd2Fy ZC13aW5uaW5nIHN1cnZleXMgYWJvdXQgU0FQCnNlY3VyaXR5LgpFUlBTY2FuIGV4cGVydHMgaGF2 ZSBiZWVuIGludGVydmlld2VkIGJ5IGxlYWRpbmcgbWVkaWEgcmVzb3VyY2VzIGFuZApmZWF0dXJl ZCBpbiBzcGVjaWFsaXplZCBpbmZvLXNlYyBwdWJsaWNhdGlvbnMgd29ybGR3aWRlLiBUaGVzZSBp bmNsdWRlClJldXRlcnMsIFlhaG9vLCBTQyBNYWdhemluZSwgVGhlIFJlZ2lzdGVyLCBDSU8sIFBD IFdvcmxkLCBEYXJrUmVhZGluZywKSGVpc2UsIGFuZCBDaGluYWJ5dGUsIHRvIG5hbWUgYSBmZXcu CldlIGhhdmUgaGlnaGx5IHF1YWxpZmllZCBleHBlcnRzIGluIHN0YWZmIHdpdGggZXhwZXJpZW5j ZSBpbiBtYW55CmRpZmZlcmVudCBmaWVsZHMgb2Ygc2VjdXJpdHksIGZyb20gd2ViIGFwcGxpY2F0 aW9ucyBhbmQKbW9iaWxlL2VtYmVkZGVkIHRvIHJldmVyc2UgZW5naW5lZXJpbmcgYW5kIElDUy9T Q0FEQSBzeXN0ZW1zLAphY2N1bXVsYXRpbmcgdGhlaXIgZXhwZXJpZW5jZSB0byBjb25kdWN0IHRo ZSBiZXN0IFNBUCBzZWN1cml0eQpyZXNlYXJjaC4KCgoxMS4gQUJPVVQgRVJQU2NhbgoKRVJQU2Nh biBpcyB0aGUgbW9zdCByZXNwZWN0ZWQgYW5kIGNyZWRpYmxlIEJ1c2luZXNzIEFwcGxpY2F0aW9u ClNlY3VyaXR5IHByb3ZpZGVyLiBGb3VuZGVkIGluIDIwMTAsIHRoZSBjb21wYW55IG9wZXJhdGVz IGdsb2JhbGx5IGFuZAplbmFibGVzIGxhcmdlIE9pbCBhbmQgR2FzLCBGaW5hbmNpYWwgYW5kIFJl dGFpbCBvcmdhbml6YXRpb25zIHRvCnNlY3VyZSB0aGVpciBtaXNzaW9uLWNyaXRpY2FsIHByb2Nl c3Nlcy4gTmFtZWQgYXMgYW4g4oCYRW1lcmdpbmcgVmVuZG9y4oCZCmluIFNlY3VyaXR5IGJ5IENS TiwgbGlzdGVkIGFtb25nIOKAnFRPUCAxMDAgU0FQIFNvbHV0aW9uIHByb3ZpZGVyc+KAnSBhbmQK ZGlzdGluZ3Vpc2hlZCBieSAzMCsgb3RoZXIgYXdhcmRzLCBFUlBTY2FuIGlzIHRoZSBsZWFkaW5n IFNBUCBTRQpwYXJ0bmVyIGluIGRpc2NvdmVyaW5nIGFuZCByZXNvbHZpbmcgc2VjdXJpdHkgdnVs bmVyYWJpbGl0aWVzLiBFUlBTY2FuCmNvbnN1bHRhbnRzIHdvcmsgd2l0aCBTQVAgU0UgaW4gV2Fs bGRvcmYgdG8gYXNzaXN0IGluIGltcHJvdmluZyB0aGUKc2VjdXJpdHkgb2YgdGhlaXIgbGF0ZXN0 IHNvbHV0aW9ucy4KRVJQU2NhbuKAmXMgcHJpbWFyeSBtaXNzaW9uIGlzIHRvIGNsb3NlIHRoZSBn YXAgYmV0d2VlbiB0ZWNobmljYWwgYW5kCmJ1c2luZXNzIHNlY3VyaXR5LCBhbmQgcHJvdmlkZSBz b2x1dGlvbnMgdG8gZXZhbHVhdGUgYW5kIHNlY3VyZSBTQVAKYW5kIE9yYWNsZSBFUlAgc3lzdGVt cyBhbmQgYnVzaW5lc3MtY3JpdGljYWwgYXBwbGljYXRpb25zIGZyb20gYm90aCwKY3liZXItYXR0 YWNrcyBhcyB3ZWxsIGFzIGludGVybmFsIGZyYXVkLiBVc3VhbGx5IG91ciBjbGllbnRzIGFyZSBs YXJnZQplbnRlcnByaXNlcywgRm9ydHVuZSAyMDAwIGNvbXBhbmllcyBhbmQgbWFuYWdlZCBzZXJ2 aWNlIHByb3ZpZGVycwp3aG9zZSByZXF1aXJlbWVudHMgYXJlIHRvIGFjdGl2ZWx5IG1vbml0b3Ig YW5kIG1hbmFnZSBzZWN1cml0eSBvZiB2YXN0ClNBUCBsYW5kc2NhcGVzIG9uIGEgZ2xvYmFsIHNj YWxlLgpXZSDigJhmb2xsb3cgdGhlIHN1buKAmSBhbmQgZnVuY3Rpb24gaW4gdHdvIGh1YnMsIGxv Y2F0ZWQgaW4gdGhlIFBhbG8gQWx0bwphbmQgQW1zdGVyZGFtIHRvIHByb3ZpZGUgdGhyZWF0IGlu dGVsbGlnZW5jZSBzZXJ2aWNlcywgYWdpbGUgc3VwcG9ydAphbmQgb3BlcmF0ZSBsb2NhbCBvZmZp Y2VzIGFuZCBwYXJ0bmVyIG5ldHdvcmsgc3Bhbm5pbmcgMjArIGNvdW50cmllcwphcm91bmQgdGhl IGdsb2JlLgoKCkFkcmVzcyBVU0E6IDIyOCBIYW1pbHRvbiBBdmVudWUsIEZsLiAzLCBQYWxvIEFs dG8sIENBLiA5NDMwMQpQaG9uZTogNjUwLjc5OC41MjU1ClR3aXR0ZXI6IEBlcnBzY2FuClNjb29w LWl0OiBCdXNpbmVzcyBBcHBsaWNhdGlvbiBTZWN1cml0eQoKX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX18KU2VudCB0aHJvdWdoIHRoZSBGdWxsIERpc2Nsb3N1 cmUgbWFpbGluZyBsaXN0Cmh0dHBzOi8vbm1hcC5vcmcvbWFpbG1hbi9saXN0aW5mby9mdWxsZGlz Y2xvc3VyZQpXZWIgQXJjaGl2ZXMgJiBSU1M6IGh0dHA6Ly9zZWNsaXN0cy5vcmcvZnVsbGRpc2Ns b3N1cmUv