SAP SE SAP Gateway
En bref
- Source
- NVD
- EPSS
- EPSS 2.51 % · centile 85 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sap
- Statut NVD
- Modified
Rechercher sur…
Description
The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could thus mislead a user to believe this information is from the legitimate service when it's not.
Faiblesses (CWE)
- CWE-74 — Neutralisation incorrecte d'éléments spéciaux (injection)
- CWE-79 — Injection de code indirecte (XSS)
Références
- http://www.securityfocus.com/bid/109074
- https://launchpad.support.sap.com/#/notes/2752614
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
- https://cxsecurity.com/ascii/WLB-2019050283
- https://drive.google.com/open?id=1aGFqggvydehSK7MFIsfKW7tO60yiF55f
- http://packetstormsecurity.com/files/153661/SAPUI5-1.0.0-SAP-Gateway-7.5-7.51-7.52-7.53-Content-Spoofing.html
- https://launchpad.support.sap.com/#/notes/2911267
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2019-1092
- GCVE · GCVE-0-2019-0319
Avis du CERT-FR
- CERTFR-2020-AVI-350 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:sap:gateway:7.5:*:*:*:*:*:*:*cpe:2.3:a:sap:gateway:7.51:*:*:*:*:*:*:*cpe:2.3:a:sap:gateway:7.52:*:*:*:*:*:*:*cpe:2.3:a:sap:gateway:7.53:*:*:*:*:*:*:*cpe:2.3:a:sap:ui5:1.0.0:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| SAP SE · SAP Gateway | affected < 7.5 ; affected < 7.51 ; affected < 7.52 ; affected < 7.53 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |