Skip to content
OpenAdvisories
Unscored CVE-2018-2502 EUVD-2018-14357GHSA-hjc3-4rh8-3fpv

TRACE method is enabled in SAP Business One Service Layer . Attacker can use XST (Cross Site Tracing) attack if frontend applications that …

Published Dec 11, 2018 · Updated Aug 5, 2024 · Assigned by sap

Vendor: SAP Product: SAP Business One Service Layer (B1_ON_HANA)

Description

TRACE method is enabled in SAP Business One Service Layer . Attacker can use XST (Cross Site Tracing) attack if frontend applications that are using Service Layer has a XSS vulnerability. This has been fixed in SAP Business One Service Layer (B1_ON_HANA, versions 9.2, 9.3).

Affected products

VendorProductAffectedFixed
SAP SAP Business One Service Layer (B1_ON_HANA) = 9.2, = 9.3 —

References