PT-2018-15551 · Sap · Sap Ui5+3

Published 2018-06-12 · Updated 2019-10-09 · CVE-2018-2424

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Hana Database versions 1.00 through 2.00 SAP UI5 version 1.00 SAP UI5 (Java) versions 7.30 through 7.50 SAP UI versions 7.40 through 7.52 SAP UI for SAP NetWeaver version 2.0

Description The issue arises from the failure to validate user input before adding it to the DOM structure. This oversight may allow malicious user-provided JavaScript code to be added to the DOM, potentially leading to the theft of user information.

Recommendations For SAP Hana Database versions 1.00 through 2.00, update to a version that includes input validation. For SAP UI5 version 1.00, update to a version that includes input validation. For SAP UI5 (Java) versions 7.30 through 7.50, update to a version that includes input validation. For SAP UI versions 7.40 through 7.52, update to a version that includes input validation. For SAP UI for SAP NetWeaver version 2.0, update to a version that includes input validation. As a temporary workaround, consider restricting user input to prevent malicious code from being added to the DOM.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-2424

Affected Products

Sap Hana Database

Sap Netweaver

Sap Ui

Sap Ui5

References · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=495289255 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2538856 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-2424 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2424 · Security Note
• http://securityfocus.com/bid/104459 · Note