PT-2018-15592 · Sap · Sap Netweaver

Publicado 2018-11-13 · Atualizado 2018-12-13 · CVE-2018-2476

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver versions 7.30, 7.31, 7.40

Description The issue is due to insufficient URL validation in forums, allowing an attacker to redirect users to a malicious site.

Recommendations For SAP NetWeaver version 7.30, update the URL validation mechanism to prevent malicious redirects. For SAP NetWeaver version 7.31, improve the URL validation process to avoid redirects to unauthorized sites. For SAP NetWeaver version 7.40, enhance the forum's URL validation to prevent attackers from redirecting users to malicious sites.

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2018-2476

Produtos afetados

Sap Netweaver

Referências · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832 · Aviso do Fabricante
• http://securityfocus.com/bid/105898 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-2476 · Nota de Segurança
• https://launchpad.support.sap.com/#/notes/2658755 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-2476 · Aviso do Fabricante