« Volver al listado

CVE-2026-0505

Estado: AnalizadaMedia (6.1)—

The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unvalidated redirection to attacker-controlled websites, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

SAP — Document Management SystemSAP — ERPSAP — S4core

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-0505",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-0505",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-10T16:28:21.921328Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP Document Management System",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_APPL 618"
            },
            {
              "status": "affected",
              "version": "S4CORE 102"
            },
            {
              "status": "affected",
              "version": "103"
            },
            {
              "status": "affected",
              "version": "104"
            },
            {
              "status": "affected",
              "version": "105"
            },
            {
              "status": "affected",
              "version": "106"
            },
            {
              "status": "affected",
              "version": "107"
            },
            {
              "status": "affected",
              "version": "108"
            },
            {
              "status": "affected",
              "version": "109"
            },
            {
              "status": "affected",
              "version": "EA-APPL 600"
            },
            {
              "status": "affected",
              "version": "602"
            },
            {
              "status": "affected",
              "version": "603"
            },
            {
              "status": "affected",
              "version": "604"
            },
            {
              "status": "affected",
              "version": "605"
            },
            {
              "status": "affected",
              "version": "606"
            },
            {
              "status": "affected",
              "version": "617"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-02-10T04:16:02.030",
  "references": [
    {
      "url": "https://me.sap.com/notes/3678417",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unvalidated redirection to attacker-controlled websites, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application."
    },
    {
      "lang": "es",
      "value": "Las aplicaciones BSP permiten a un usuario no autenticado manipular parámetros URL controlados por el usuario que no están suficientemente validados. Esto podría resultar en una redirección no validada a sitios web controlados por el atacante, lo que conlleva un impacto bajo en la confidencialidad y la integridad, y ningún impacto en la disponibilidad de la aplicación."
    }
  ],
  "lastModified": "2026-06-17T10:10:51.683",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:document_management_system:600:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FD522469-1153-4A3C-9271-2338A5674BDA"
            },
            {
              "criteria": "cpe:2.3:a:sap:document_management_system:602:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D355E922-5592-41C7-ACE4-311044B9E8C3"
            },
            {
              "criteria": "cpe:2.3:a:sap:document_management_system:603:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E8A41C8-812E-4319-B515-CF9F030DAA19"
            },
            {
              "criteria": "cpe:2.3:a:sap:document_management_system:604:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B470B7D-486C-43B0-B9B0-AC0A16034A01"
            },
            {
              "criteria": "cpe:2.3:a:sap:document_management_system:605:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0024390E-91C7-48B5-8E04-265E9E6D4E75"
            },
            {
              "criteria": "cpe:2.3:a:sap:document_management_system:606:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "133C3E0D-2D67-479A-A678-07EB04244BCB"
            },
            {
              "criteria": "cpe:2.3:a:sap:document_management_system:617:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7E1D717-FA00-47D5-94B6-E818848890C6"
            },
            {
              "criteria": "cpe:2.3:a:sap:erp:618:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4573BD22-D50B-431E-928A-C495E342D1AE"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:102:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04C95A73-48EB-446C-A5F0-20E1D6BC1779"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:103:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C3C9003-68A6-4886-8979-9B7D01A35E40"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:104:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "964023CE-6EA4-42BB-93B2-DCE6B36D3F89"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:105:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84B775EF-6C11-4FAB-B5E7-8F6C4C5674BE"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:106:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "14D17245-5B6D-4024-AFA6-8E0A70B294BF"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:107:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5DEFABE8-1797-4C7B-941C-3205AE90914B"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:108:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78832FB6-B1DD-4516-B1DF-D90BB58BF25A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}