PT-2018-15536 · Sap · Sap Solution Manager

Published 2018-04-10 · Updated 2019-10-09 · CVE-2018-2405

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Solution Manager versions 7.10 through 7.20

Description The Incident Management Work Center in SAP Solution Manager allows an attacker to upload a malicious script as an attachment, which could lead to possible Cross-Site Scripting.

Recommendations For SAP Solution Manager versions 7.10 through 7.20, restrict access to the attachment upload feature in the Incident Management Work Center to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-2405

Affected Products

Sap Solution Manager

References · 5

• https://osv.dev/vulnerability/CVE-2018-2405 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2405 · Security Note
• https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2372688 · Note
• http://securityfocus.com/bid/103703 · Note