PT-2018-15503 · Sap · Fiori Bi Launchpad+2

Published 2018-02-14 · Updated 2018-03-15 · CVE-2018-2370

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Central Management Console, BI Launchpad and Fiori BI Launchpad versions 4.10, from 4.20, from 4.30

Description The issue allows a malicious user to use common techniques to determine which ports are in use on the backend server. This is due to a Server Side Request Forgery (SSRF) vulnerability.

Recommendations For versions 4.10, consider restricting access to the backend server to minimize the risk of exploitation. For versions from 4.20, from 4.30, avoid using common techniques that could be used to determine open ports on the backend server until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2018-2370

Affected Products

Bi Launchpad

Fiori Bi Launchpad

Sap Central Management Console

References · 5

• https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2370 · Security Note
• https://osv.dev/vulnerability/CVE-2018-2370 · Vendor Advisory
• http://securityfocus.com/bid/102998 · Note
• https://launchpad.support.sap.com/#/notes/2493727 · Note