PT-2018-15551 · Sap · Sap Ui5+3

Publicado 2018-06-12 · Atualizado 2019-10-09 · CVE-2018-2424

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Hana Database versions 1.00 through 2.00 SAP UI5 version 1.00 SAP UI5 (Java) versions 7.30 through 7.50 SAP UI versions 7.40 through 7.52 SAP UI for SAP NetWeaver version 2.0

Description The issue arises from the failure to validate user input before adding it to the DOM structure. This oversight may allow malicious user-provided JavaScript code to be added to the DOM, potentially leading to the theft of user information.

Recommendations For SAP Hana Database versions 1.00 through 2.00, update to a version that includes input validation. For SAP UI5 version 1.00, update to a version that includes input validation. For SAP UI5 (Java) versions 7.30 through 7.50, update to a version that includes input validation. For SAP UI versions 7.40 through 7.52, update to a version that includes input validation. For SAP UI for SAP NetWeaver version 2.0, update to a version that includes input validation. As a temporary workaround, consider restricting user input to prevent malicious code from being added to the DOM.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-2424

Produtos afetados

Sap Hana Database

Sap Netweaver

Sap Ui

Sap Ui5

Referências · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=495289255 · Aviso do Fabricante
• http://securityfocus.com/bid/104459 · Nota
• https://launchpad.support.sap.com/#/notes/2538856 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-2424 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-2424 · Nota de Segurança