A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which might fool an end user: UI add-on for SAP NetWeaver (UI_Infra, 1.0), SAP UI Implementation for Decoupled Innovations (UI_700, 2.0): SAP NetWeaver 7.00 Implementation, SAP User Interface Technology (SAP_UI 7.4, 7.5, 7.51, 7.52). There is little impact as it is not possible to embed active contents such as JavaScript or hyperlinks.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/bid/105088 | Third Party Advisory VDB Entry |
| https://launchpad.support.sap.com/#/notes/2633180 | Permissions Required Vendor Advisory |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000 | Vendor Advisory |
| http://www.securityfocus.com/bid/105088 | Third Party Advisory VDB Entry |
| https://launchpad.support.sap.com/#/notes/2633180 | Permissions Required Vendor Advisory |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 04:03
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.securityfocus.com/bid/105088 - Third Party Advisory, VDB Entry | |
| References | () https://launchpad.support.sap.com/#/notes/2633180 - Permissions Required, Vendor Advisory | |
| References | () https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000 - Vendor Advisory |
Information
Published : 2018-07-10 18:29
Updated : 2024-11-21 04:03
NVD link : CVE-2018-2434
Mitre link : CVE-2018-2434
CVE.ORG link : CVE-2018-2434
JSON object : View
Products Affected
sap
- netweaver
- user_interface_technology
- ui_infra
CWE
CWE-345
Insufficient Verification of Data Authenticity