Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2018-2502

TRACE method is enabled in SAP Business One Service Layer . Attacker can use XST (Cross Site Tracing) attack if frontend applications that are using Service Layer has a XSS vulnera

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

TRACE method is enabled in SAP Business One Service Layer . Attacker can use XST (Cross Site Tracing) attack if frontend applications that are using Service Layer has a XSS vulnerability. This has been fixed in SAP Business One Service Layer (B1_ON_HANA, versions 9.2, 9.3).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP SAP Business One Service Layer (B1_ON_HANA)

  • = 9.2affected
  • = 9.3affected

References