PT-2017-13497 · Sap · Sap E-Recruiting

Publicado 2017-09-17 · Atualizado 2017-09-28 · CVE-2017-14511

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SAP E-Recruiting versions 605 through 617

Description An issue in the registration process of SAP E-Recruiting allows attackers to bypass email confirmation and register email addresses they do not have access to. This is due to the predictability of candidate hrobject and improper validation of corr act guid. As a result, an attacker could prevent legitimate users from registering with an already registered email address.

Recommendations For SAP E-Recruiting versions 605 through 617, apply the fix provided in SAP Security Note 2507798 to address the issue with email confirmation bypass and improper validation of corr act guid.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-14511

Produtos afetados

Sap E-Recruiting

Referências · 5

• https://launchpad.support.sap.com/#/notes/2507798 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14511 · Nota de Segurança
• https://blogs.sap.com/2017/09/12/sap-security-patch-day-september-2017 · Aviso do Fabricante
• https://sec-consult.com/en/blog/advisories/email-verification-bypass-in-sap-e-recruiting/index.html · Nota
• https://osv.dev/vulnerability/CVE-2017-14511 · Aviso do Fabricante