PT-2006-1783 · Sap · Sap Business Connector

Published 2006-02-16 · Updated 2018-10-19 · CVE-2006-0731

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP Business Connector Core Fix versions prior to 8

Description The issue allows remote attackers to conduct spoofing attacks via an absolute URL in the url parameter, which loads the URL inside a frame. This can be exploited by providing a malicious absolute URL.

Recommendations For SAP Business Connector Core Fix versions prior to 8, update to a version newer than 7 to resolve the issue. As a temporary workaround, consider restricting access to the url parameter in the WmRoot/adapter-index.dsp to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-0731

Affected Products

Sap Business Connector

References · 12

• 🔥 https://exploit-db.com/exploits/27233 · Exploit
• 🔥 https://exploit-db.com/exploits/27234 · Exploit
• 🔥 https://exploit-db.com/exploits/27235 · Exploit
• http://secunia.com/advisories/18880 · Vendor Advisory
• http://cybsec.com/vuln/CYBSEC_Security_Pre-Advisory_Phishing_Vector_in_SAP_BC.pdf · Vendor Advisory
• http://vupen.com/english/advisories/2006/0611 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0731 · Security Note
• http://securitytracker.com/id?1015639 · Note
• http://securityfocus.com/archive/1/434012/30/4980/threaded · Note
• http://securityfocus.com/archive/1/425056/100/0/threaded · Note
• http://securityfocus.com/bid/16671 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24751 · Note