« Volver al listado

CVE-2018-2434

Estado: ModificadaMedia (4.3)—

A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which might fool an end user: UI add-on for SAP NetWeaver (UI_Infra, 1.0), SAP UI Implementation for Decoupled Innovations (UI_700, 2.0): SAP NetWeaver 7.00 Implementation, SAP User Interface Technology (SAP_UI 7.4, 7.5, 7.51, 7.52). There is little impact as it is not possible to embed active contents such as JavaScript or hyperlinks.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

SAP — NetweaverSAP — UI InfraSAP — User Interface Technology

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-2434",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP",
          "product": "SAP NetWeaver (UI_Infra)",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.0"
            }
          ]
        },
        {
          "vendor": "SAP",
          "product": "SAP UI Implementation for Decoupled Innovations (UI_700)",
          "versions": [
            {
              "status": "affected",
              "version": "= 2.0"
            }
          ]
        },
        {
          "vendor": "SAP",
          "product": "SAP NetWeaver",
          "versions": [
            {
              "status": "affected",
              "version": "= 7.0"
            }
          ]
        },
        {
          "vendor": "SAP",
          "product": "SAP User Interface Technology (SAP_UI)",
          "versions": [
            {
              "status": "affected",
              "version": "= 7.4"
            },
            {
              "status": "affected",
              "version": "= 7.5"
            },
            {
              "status": "affected",
              "version": "= 7.51"
            },
            {
              "status": "affected",
              "version": "= 7.52"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-07-10T18:29:00.967",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/105088",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2633180",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/105088",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2633180",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which might fool an end user: UI add-on for SAP NetWeaver (UI_Infra, 1.0), SAP UI Implementation for Decoupled Innovations (UI_700, 2.0): SAP NetWeaver 7.00 Implementation, SAP User Interface Technology (SAP_UI 7.4, 7.5, 7.51, 7.52). There is little impact as it is not possible to embed active contents such as JavaScript or hyperlinks."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de suplantación de contenido en los siguentes componentes permite renderizar páginas HTML que contienen texto plano arbitrario, lo que podría engañar a un usuario final: UI add-on para SAP NetWeaver (UI_Infra, 1.0), SAP UI Implementation para Decoupled Innovations (UI_700, 2.0): SAP NetWeaver 7.00 Implementation, SAP User Interface Technology (SAP_UI 7.4, 7.5, 7.51 y 7.52). No supone mucho impacto, ya que no es posible embeber contenido activo como JavaScript o hipervínculos."
    }
  ],
  "lastModified": "2026-06-17T01:55:41.510",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:netweaver:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "41FAC5DD-D577-47F9-B0CA-006032256642"
            },
            {
              "criteria": "cpe:2.3:a:sap:ui_infra:1.0:*:*:*:*:netweaver:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7DD5CD65-0219-4EBF-8F7E-35CAAB855EC6"
            },
            {
              "criteria": "cpe:2.3:a:sap:user_interface_technology:7.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35C9C962-EE9F-441A-9DD7-BBAAC8D31297"
            },
            {
              "criteria": "cpe:2.3:a:sap:user_interface_technology:7.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6DF1996-37A7-4C8D-9869-80EBA93243C9"
            },
            {
              "criteria": "cpe:2.3:a:sap:user_interface_technology:7.51:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62E6239F-04B5-44BB-8589-788A77A68081"
            },
            {
              "criteria": "cpe:2.3:a:sap:user_interface_technology:7.52:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B78A3DD-80C5-4DBD-8BF7-27E923262B45"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}