PT-2018-15503 · Sap · Fiori Bi Launchpad+2

Publicado 2018-02-14 · Atualizado 2018-03-15 · CVE-2018-2370

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Central Management Console, BI Launchpad and Fiori BI Launchpad versions 4.10, from 4.20, from 4.30

Description The issue allows a malicious user to use common techniques to determine which ports are in use on the backend server. This is due to a Server Side Request Forgery (SSRF) vulnerability.

Recommendations For versions 4.10, consider restricting access to the backend server to minimize the risk of exploitation. For versions from 4.20, from 4.30, avoid using common techniques that could be used to determine open ports on the backend server until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2018-2370

Produtos afetados

Bi Launchpad

Fiori Bi Launchpad

Sap Central Management Console

Referências · 5

• https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-2370 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-2370 · Aviso do Fabricante
• http://securityfocus.com/bid/102998 · Nota
• https://launchpad.support.sap.com/#/notes/2493727 · Nota