PT-2017-3777 · Sap · Sap Fiori Client

Publicado 2017-12-15 · Atualizado 2019-10-03 · CVE-2018-2485

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SAP Fiori Client versions prior to 1.11.5

Description The issue is related to insufficient access control in the SAP Fiori Client mobile environment, allowing a remote attacker to gain unauthorized access to protected information and execute arbitrary JavaScript code. This can include reading and writing of information and calling device-specific JavaScript APIs in the application.

Recommendations For versions prior to 1.11.5, update to SAP Fiori Client version 1.11.5 to address the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2019-01224

CVE-2018-2485

Produtos afetados

Sap Fiori Client

Referências · 8

• http://securityfocus.com/bid/105911 · Nota
• https://securityfocus.com/bid/105911/discuss · Nota
• https://launchpad.support.sap.com/#/notes/2691126 · Aviso do Fabricante
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-2485 · Aviso do Fabricante
• https://threatpost.ru/sap-published-monthly-security-updates/29196 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-2485 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-01224 · Nota de Segurança