PT-2018-15600
CVE-2018-2491
·
تاريخ النشر
2018-11-13
·
تاريخ التحديث
2019-02-01
الوصف من
CVSS 3.1
7.8
عاليةالمقاييسAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
SAP Fiori Client versions prior to 1.11.5
Description
The issue allows malicious JavaScript code embedded in a deep link URL to run inside the application's built-in log viewer when the log level is set to "Debug" and the user opens the viewer and taps on the hyperlink.
Recommendations
For versions prior to 1.11.5, update to version 1.11.5 to resolve the issue. As a temporary workaround, consider avoiding the use of the "Debug" log level and refrain from tapping on hyperlinks in the log viewer until the update is applied.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾