PT-2018-15603 · Sap · Sap Business One Service Layer

Publicado 2018-12-11 · Atualizado 2019-01-07 · CVE-2018-2502

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Business One Service Layer versions prior to 9.2 and 9.3

Description The issue allows an attacker to potentially use a Cross Site Tracing (XST) attack if the frontend applications using the Service Layer have a Cross-Site Scripting (XSS) vulnerability, due to the TRACE method being enabled.

Recommendations For SAP Business One Service Layer versions prior to 9.2 and 9.3, update to version 9.2 or 9.3 to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-2502

Produtos afetados

Sap Business One Service Layer

Referências · 5

• https://osv.dev/vulnerability/CVE-2018-2502 · Aviso do Fabricante
• https://launchpad.support.sap.com/#/notes/2680492 · Aviso do Fabricante
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699 · Aviso do Fabricante
• http://securityfocus.com/bid/106173 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-2502 · Nota de Segurança