PT-2021-14544 · Sap · Sap Ui5

Published 2021-02-09 · Updated 2021-04-01 · CVE-2021-21476

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP UI5 versions before 1.38.49 SAP UI5 versions before 1.52.49 SAP UI5 versions before 1.60.34 SAP UI5 versions before 1.71.31 SAP UI5 versions before 1.78.18 SAP UI5 versions before 1.84.5 SAP UI5 versions before 1.85.4 SAP UI5 versions before 1.86.1

Description The issue allows an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.

Recommendations For SAP UI5 version before 1.38.49, update to version 1.38.49 or later. For SAP UI5 version before 1.52.49, update to version 1.52.49 or later. For SAP UI5 version before 1.60.34, update to version 1.60.34 or later. For SAP UI5 version before 1.71.31, update to version 1.71.31 or later. For SAP UI5 version before 1.78.18, update to version 1.78.18 or later. For SAP UI5 version before 1.84.5, update to version 1.84.5 or later. For SAP UI5 version before 1.85.4, update to version 1.85.4 or later. For SAP UI5 version before 1.86.1, update to version 1.86.1 or later.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2021-21476

Affected Products

Sap Ui5

References · 5

• https://osv.dev/vulnerability/CVE-2021-21476 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21476 · Security Note
• https://launchpad.support.sap.com/#/notes/3014303 · Note
• https://t.me/cibsecurity/23339 · Telegram Post