PT-2018-15600 · Sap · Sap Fiori Client

Publicado 2018-11-13 · Atualizado 2019-02-01 · CVE-2018-2491

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Fiori Client versions prior to 1.11.5

Description The issue allows malicious JavaScript code embedded in a deep link URL to run inside the application's built-in log viewer when the log level is set to "Debug" and the user opens the viewer and taps on the hyperlink.

Recommendations For versions prior to 1.11.5, update to version 1.11.5 to resolve the issue. As a temporary workaround, consider avoiding the use of the "Debug" log level and refrain from tapping on hyperlinks in the log viewer until the update is applied.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2018-2491

Produtos afetados

Sap Fiori Client

Referências · 4

• https://osv.dev/vulnerability/CVE-2018-2491 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-2491 · Nota de Segurança
• https://launchpad.support.sap.com/#/notes/2691126 · Aviso do Fabricante
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832 · Aviso do Fabricante