CVE-2015-6663: Cross-site scripting (XSS) vulnerability in the Client form in the Device Inspector page in SAP Afaria 7 al...

Security readout for executives and security teams

This issue lets an attacker place script or HTML into SAP Afaria 7 client name data shown in the Device Inspector page. If viewed by an administrator, it could run in that user’s browser. The provided sources do not include CVSS, confirmed affected versions beyond Afaria 7, or active exploitation evidence. Exposure is most likely in organizations still operating SAP Afaria 7, especially where Device Inspector or administrative functions are reachable by broad internal users. The source bundle does not identify other affected products or exact vulnerable builds. Prioritize this where SAP Afaria 7 manages enterprise mobile devices or is reachable by many users. Business urgency is lower than a remote code execution flaw, but administrator-session XSS in a management console can support credential theft or unauthorized administrative actions. Mitigation focus: Inventory SAP Afaria 7 instances and administrative access paths.; Review SAP Security Note 2152669 and current SAP support guidance.; Restrict Afaria administrative interfaces to trusted networks and users..

Prepared

Jun 13, 2026, 22:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.