---
cve: "CVE-2008-2123"
severity: "LOW"
cvss: 3.1
epss: "2.3%"
vendor: "n/a"
kev: false
exploited: false
published: "2008-05-09 18:20:00"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-11T09:50:11+02:00"
---

# CVE-2008-2123

> 3.1 LOW

## Beschreibung

Cross-site scripting (XSS) vulnerability in WGate in SAP Internet Transaction Server (ITS) 6.20 allows remote attackers to inject arbitrary web script or HTML via (1) a "" sequence in the ~service parameter to wgate.dll, or (2) Javascript splicing in the query string, a different vector than CVE-2006-5114.

## Exploit-Evidenz

- [EDB-31754 — SAP Internet Transaction Server 6200.1017.50954.0 Bu (WGate) - 'wgate.dll?~service' Cross-Site Scripting](https://www.exploit-db.com/exploits/31754) ✅
- [EDB-31755 — SAP Internet Transaction Server 6200.1017.50954.0 - Bu query String JavaScript Splicing Cross-Site Scripting](https://www.exploit-db.com/exploits/31755) ✅

## Referenzen

- <http://secunia.com/advisories/30128>
- <http://www.securityfocus.com/bid/29103>
- <http://www.vupen.com/english/advisories/2008/1466/references>
- <http://www.securitytracker.com/id?1019998>
- <http://www.portcullis-security.com/275.php>
- <https://exchange.xforce.ibmcloud.com/vulnerabilities/42281>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2008-2123) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_