CVE-2018-2502

Summary

TRACE method is enabled in SAP Business One Service Layer . Attacker can use XST (Cross Site Tracing) attack if frontend applications that are using Service Layer has a XSS vulnerability. This has been fixed in SAP Business One Service Layer (B1_ON_HANA, versions 9.2, 9.3).

Affected Software

Weaknesses

• Other

ADP Enrichment

CVE Program Container

Additional References

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699
• http://www.securityfocus.com/bid/106173
• https://launchpad.support.sap.com/#/notes/2680492

References

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699
• http://www.securityfocus.com/bid/106173
• https://launchpad.support.sap.com/#/notes/2680492

• ←Previous
• Next→