PT-2017-13497
CVE-2017-14511
·
تاريخ النشر
2017-09-17
·
تاريخ التحديث
2017-09-28
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions
SAP E-Recruiting versions 605 through 617
Description
An issue in the registration process of SAP E-Recruiting allows attackers to bypass email confirmation and register email addresses they do not have access to. This is due to the predictability of
candidate hrobject and improper validation of corr act guid. As a result, an attacker could prevent legitimate users from registering with an already registered email address.Recommendations
For SAP E-Recruiting versions 605 through 617, apply the fix provided in SAP Security Note 2507798 to address the issue with email confirmation bypass and improper validation of
corr act guid. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾