PT-2018-15536 · Sap · Sap Solution Manager

Publicado 2018-04-10 · Atualizado 2019-10-09 · CVE-2018-2405

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Solution Manager versions 7.10 through 7.20

Description The Incident Management Work Center in SAP Solution Manager allows an attacker to upload a malicious script as an attachment, which could lead to possible Cross-Site Scripting.

Recommendations For SAP Solution Manager versions 7.10 through 7.20, restrict access to the attachment upload feature in the Incident Management Work Center to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-2405

Produtos afetados

Sap Solution Manager

Referências · 5

• https://launchpad.support.sap.com/#/notes/2372688 · Nota
• http://securityfocus.com/bid/103703 · Nota
• https://osv.dev/vulnerability/CVE-2018-2405 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-2405 · Nota de Segurança
• https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018 · Aviso do Fabricante