« Volver al listado

CVE-2018-2505

Estado: ModificadaMedia (6.1)—

SAP Commerce does not sufficiently validate user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability in storefronts that are based on the product. Fixed in versions (SAP Hybris Commerce, versions 6.2, 6.3, 6.4, 6.5, 6.6, 6.7).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Hybris

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-2505",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP",
          "product": "SAP Commerce (SAP Hybris Commerce)",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "status": "affected",
              "version": "6.7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-12-11T22:29:00.703",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/106151",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2711425",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/106151",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2711425",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Commerce does not sufficiently validate user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability in storefronts that are based on the product. Fixed in versions (SAP Hybris Commerce, versions 6.2, 6.3, 6.4, 6.5, 6.6, 6.7)."
    },
    {
      "lang": "es",
      "value": "SAP Commerce no valida lo suficiente las entradas controladas por el usuario, lo que resulta en una vulnerabilidad Cross-Site Scripting (XSS) en los storefronts que se basan en este producto. Se ha solucionado en las versiones 6.2, 6.3, 6.4, 6.5, 6.6 y 6.7 de SAP Hybris Commerce."
    }
  ],
  "lastModified": "2026-06-17T01:55:48.003",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:hybris:6.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "77D0690C-687F-4D21-97C9-6AE1F00DBE0A"
            },
            {
              "criteria": "cpe:2.3:a:sap:hybris:6.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9C58B26-222E-47C6-AF6D-9F7DE48BB78F"
            },
            {
              "criteria": "cpe:2.3:a:sap:hybris:6.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB842B1C-BFD7-43D8-88D4-ED677AC1470E"
            },
            {
              "criteria": "cpe:2.3:a:sap:hybris:6.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "955A7DD3-972A-4E04-B27D-BD5AE3E27306"
            },
            {
              "criteria": "cpe:2.3:a:sap:hybris:6.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6C7DB50-EC03-4F30-847B-375122121886"
            },
            {
              "criteria": "cpe:2.3:a:sap:hybris:6.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B7349C8-B134-41BC-A99E-5B2723E44EFA"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}