CVE-2018-2434

Published: Jul 10, 2018Modified: Nov 21, 2024

4.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which might fool an end user: UI add-on for SAP NetWeaver (UI_Infra, 1.0), SAP UI Implementation for Decoupled Innovations (UI_700, 2.0): SAP NetWeaver 7.00 Implementation, SAP User Interface Technology (SAP_UI 7.4, 7.5, 7.51, 7.52). There is little impact as it is not possible to embed active contents such as JavaScript or hyperlinks.

Affected (6)

Products: Sap: Netweaver, Ui Infra, User Interface Technology

Sap

3 products

Netweaver

Ui Infra

User Interface Technology

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Sap Netweaver	Version 7.0
Sap Ui Infra	Version 1.0
Sap User Interface Technology	Version 7.4
Sap User Interface Technology	Version 7.51
Sap User Interface Technology	Version 7.52
Sap User Interface Technology	Version 7.5