PT-2024-1554 · Sap · Sap Marketing

Published 2024-01-08 · Updated 2024-01-12 · CVE-2024-21734

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP Marketing (Contacts App) version 160

Description The issue is related to a URL redirection vulnerability in the Contacts App component of the SAP Marketing system, which can be exploited by a remote attacker to conduct a phishing attack. This could potentially lead to the disclosure of protected information through a specially crafted malicious link. The vulnerability allows an attacker with low privileges to trick a user into opening a malicious page, resulting in a convincing phishing attack with low impact on the confidentiality and integrity of the application.

Recommendations For SAP Marketing (Contacts App) version 160, consider restricting access to the vulnerable component to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using links from untrusted sources to prevent potential phishing attacks.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2024-01098

CVE-2024-21734

Affected Products

Sap Marketing

References · 7

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21734 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01098 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21734 · Security Note
• https://twitter.com/CVEnew/status/1744541357559935248 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1744610570291106142 · Twitter Post
• https://me.sap.com/notes/3190894 · Note