description: SAP NetWeaver AS for ABAP (Web Survey), versions - 700, 702, 710, 711, 730, 731, 750, 750, 752, 75A, 75F, does not sufficiently encode input and output parameters which results in reflected cross site scripting vulnerability, through which a malicious user can access data relating to the current session and use it to impersonate a user and access all information with the same rights as the target user.
problem types: Cross Site Scripting
affected:
{
product: SAP NetWeaver AS for ABAP (Web Survey)
vendor: SAP SE
versions:
status: affected, version: < 700
status: affected, version: < 702
status: affected, version: < 710
status: affected, version: < 711
status: affected, version: < 730
status: affected, version: < 731
status: affected, version: < 750
status: affected, version: < 752
status: affected, version: < 75A
status: affected, version: < 75F
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.0
]