CVE-2018-2434 (GCVE-0-2018-2434)
Vulnerability from cvelistv5
Published
2018-07-10 18:00
Modified
2024-08-05 04:21
Severity ?
CWE
  • Content Spoofing
Summary
A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which might fool an end user: UI add-on for SAP NetWeaver (UI_Infra, 1.0), SAP UI Implementation for Decoupled Innovations (UI_700, 2.0): SAP NetWeaver 7.00 Implementation, SAP User Interface Technology (SAP_UI 7.4, 7.5, 7.51, 7.52). There is little impact as it is not possible to embed active contents such as JavaScript or hyperlinks.
References
Impacted products
Vendor Product Version
SAP SAP NetWeaver (UI_Infra) Version: = 1.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T04:21:33.594Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "105088",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105088"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/2633180"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAP NetWeaver (UI_Infra)",
          "vendor": "SAP",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.0"
            }
          ]
        },
        {
          "product": "SAP UI Implementation for Decoupled Innovations (UI_700)",
          "vendor": "SAP",
          "versions": [
            {
              "status": "affected",
              "version": "= 2.0"
            }
          ]
        },
        {
          "product": "SAP NetWeaver ",
          "vendor": "SAP",
          "versions": [
            {
              "status": "affected",
              "version": "= 7.0"
            }
          ]
        },
        {
          "product": "SAP User Interface Technology (SAP_UI)",
          "vendor": "SAP",
          "versions": [
            {
              "status": "affected",
              "version": "= 7.4"
            },
            {
              "status": "affected",
              "version": "= 7.5"
            },
            {
              "status": "affected",
              "version": "= 7.51"
            },
            {
              "status": "affected",
              "version": "= 7.52"
            }
          ]
        }
      ],
      "datePublic": "2018-07-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which might fool an end user: UI add-on for SAP NetWeaver (UI_Infra, 1.0), SAP UI Implementation for Decoupled Innovations (UI_700, 2.0): SAP NetWeaver 7.00 Implementation, SAP User Interface Technology (SAP_UI 7.4, 7.5, 7.51, 7.52). There is little impact as it is not possible to embed active contents such as JavaScript or hyperlinks."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Content Spoofing ",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-08-16T09:57:01",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "name": "105088",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105088"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/2633180"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2018-2434",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP NetWeaver (UI_Infra)",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "=",
                            "version_value": "1.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SAP UI Implementation for Decoupled Innovations (UI_700)",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "=",
                            "version_value": "2.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SAP NetWeaver ",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "=",
                            "version_value": "7.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SAP User Interface Technology (SAP_UI)",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "=",
                            "version_value": "7.4"
                          },
                          {
                            "version_name": "=",
                            "version_value": "7.5"
                          },
                          {
                            "version_name": "=",
                            "version_value": "7.51"
                          },
                          {
                            "version_name": "=",
                            "version_value": "7.52"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which might fool an end user: UI add-on for SAP NetWeaver (UI_Infra, 1.0), SAP UI Implementation for Decoupled Innovations (UI_700, 2.0): SAP NetWeaver 7.00 Implementation, SAP User Interface Technology (SAP_UI 7.4, 7.5, 7.51, 7.52). There is little impact as it is not possible to embed active contents such as JavaScript or hyperlinks."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Content Spoofing "
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "105088",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105088"
            },
            {
              "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000",
              "refsource": "CONFIRM",
              "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/2633180",
              "refsource": "MISC",
              "url": "https://launchpad.support.sap.com/#/notes/2633180"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2018-2434",
    "datePublished": "2018-07-10T18:00:00",
    "dateReserved": "2017-12-15T00:00:00",
    "dateUpdated": "2024-08-05T04:21:33.594Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2018-2434\",\"sourceIdentifier\":\"cna@sap.com\",\"published\":\"2018-07-10T18:29:00.967\",\"lastModified\":\"2024-11-21T04:03:48.430\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which might fool an end user: UI add-on for SAP NetWeaver (UI_Infra, 1.0), SAP UI Implementation for Decoupled Innovations (UI_700, 2.0): SAP NetWeaver 7.00 Implementation, SAP User Interface Technology (SAP_UI 7.4, 7.5, 7.51, 7.52). There is little impact as it is not possible to embed active contents such as JavaScript or hyperlinks.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de suplantaci\u00f3n de contenido en los siguentes componentes permite renderizar p\u00e1ginas HTML que contienen texto plano arbitrario, lo que podr\u00eda enga\u00f1ar a un usuario final: UI add-on para SAP NetWeaver (UI_Infra, 1.0), SAP UI Implementation para Decoupled Innovations (UI_700, 2.0): SAP NetWeaver 7.00 Implementation, SAP User Interface Technology (SAP_UI 7.4, 7.5, 7.51 y 7.52). No supone mucho impacto, ya que no es posible embeber contenido activo como JavaScript o hiperv\u00ednculos.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-345\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"41FAC5DD-D577-47F9-B0CA-006032256642\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:ui_infra:1.0:*:*:*:*:netweaver:*:*\",\"matchCriteriaId\":\"7DD5CD65-0219-4EBF-8F7E-35CAAB855EC6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:user_interface_technology:7.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"35C9C962-EE9F-441A-9DD7-BBAAC8D31297\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:user_interface_technology:7.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C6DF1996-37A7-4C8D-9869-80EBA93243C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:user_interface_technology:7.51:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"62E6239F-04B5-44BB-8589-788A77A68081\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:user_interface_technology:7.52:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2B78A3DD-80C5-4DBD-8BF7-27E923262B45\"}]}]}],\"references\":[{\"url\":\"http://www.securityfocus.com/bid/105088\",\"source\":\"cna@sap.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://launchpad.support.sap.com/#/notes/2633180\",\"source\":\"cna@sap.com\",\"tags\":[\"Permissions Required\",\"Vendor Advisory\"]},{\"url\":\"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000\",\"source\":\"cna@sap.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/105088\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://launchpad.support.sap.com/#/notes/2633180\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\",\"Vendor Advisory\"]},{\"url\":\"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.