PT-2020-19014 · Sap · Sap Netweaver As Abap

Published 2020-04-14 · Updated 2023-10-06 · CVE-2020-6215

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754

Description The issue allows an attacker to redirect users to a malicious site due to insufficient URL validation, potentially leading to the theft of victim credentials. This is a result of a URL Redirection vulnerability.

Recommendations For versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, consider disabling the vulnerable Business Server Pages Test Application IT00 until a patch is available to prevent URL redirection attacks. Restrict access to the application to minimize the risk of exploitation. Avoid using potentially vulnerable URL redirects in the application until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2020-6215

Affected Products

Sap Netweaver As Abap

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-6215 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6215 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2872782 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 · Vendor Advisory
• https://twitter.com/buaqbot/status/1710164179255013642 · Twitter Post
• http://packetstormsecurity.com/files/174985/SAP-Application-Server-ABAP-Open-Redirection.html · Note
• https://t.me/cvenotify/59071 · Telegram Post
• http://seclists.org/fulldisclosure/2023/Oct/13 · Note