CVE:CVE-2010-2904
CNNVD:CNNVD-201007-294
SAP NetWeaver中的System Landscape Directory (SLD)组件的6.4 到 7.02版本中存在多个跨站脚本攻击漏洞。远程攻击者可以借助在(1) testsdic的action参数和(2) paramhelp.jsp的helpstring参数注入任意的web脚本和HTML。
solution:Upgrade sap system_landscape_directory to a higher version than 6.4,7.0,7.02,and avoid the version 6.4,7.0,7.02; Upgrade sap netweaver to a higher version than *,6.4,7.0,and avoid the version 6.4,7.0