CVE-2011-4707
SAP NetWeaver - Cross-Site Scripting via VsiTestScan and VsiTestServlet Parameters
Title source: llmDescription
Multiple cross-site scripting (XSS) vulnerabilities in the Virus Scan Interface in SAP Netweaver allow remote attackers to inject arbitrary web script or HTML via the (1) instname parameter to the VsiTestScan servlet and (2) name parameter to the VsiTestServlet servlet.
References (5)
Core 5
Core References
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/520554/100/0/threaded
Various Sources x_refsource_misc
http://dsecrg.com/pages/vul/show.php?id=336
Various Sources x_refsource_confirm
http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a
Third Party Advisory x_refsource_misc
https://erpscan.io/advisories/dsecrg-11-036-sap-netwaver-virus-scan-interface-multiple-xss/
Various Sources x_refsource_confirm
https://service.sap.com/sap/support/notes/1546307
Scores
EPSS
0.0033
EPSS Percentile
55.9%
Details
CWE
CWE-79
Status
published
Products (1)
sap/netweaver
Published
Dec 08, 2011
Tracked Since
Feb 18, 2026