CVE-2018-2505

SAP Commerce does not sufficiently validate user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability in storefronts that are based on the product. Fixed in versions (SAP Hybris Commerce, versions 6.2, 6.3, 6.4, 6.5, 6.6, 6.7).

CVSS v3 6.1 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/106151	Third Party Advisory VDB Entry
https://launchpad.support.sap.com/#/notes/2711425	Permissions Required Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sap:hybris:6.2:::::::*
	cpe:2.3:a:sap:hybris:6.3:::::::*
	cpe:2.3:a:sap:hybris:6.4:::::::*
	cpe:2.3:a:sap:hybris:6.5:::::::*
	cpe:2.3:a:sap:hybris:6.6:::::::*
	cpe:2.3:a:sap:hybris:6.7:::::::*

History

No history.

Information

Published : 2018-12-11 22:29

Updated : 2023-12-10 12:44

NVD link : CVE-2018-2505

Mitre link : CVE-2018-2505

CVE.ORG link : CVE-2018-2505

JSON object : View

Products Affected

sap

hybris

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2018-2505", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2018-12-11T22:29:00.703", "references": [{"url": "http://www.securityfocus.com/bid/106151", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cna@sap.com"}, {"url": "https://launchpad.support.sap.com/#/notes/2711425", "tags": ["Permissions Required", "Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "SAP Commerce does not sufficiently validate user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability in storefronts that are based on the product. Fixed in versions (SAP Hybris Commerce, versions 6.2, 6.3, 6.4, 6.5, 6.6, 6.7)."}, {"lang": "es", "value": "SAP Commerce no valida lo suficiente las entradas controladas por el usuario, lo que resulta en una vulnerabilidad Cross-Site Scripting (XSS) en los storefronts que se basan en este producto. Se ha solucionado en las versiones 6.2, 6.3, 6.4, 6.5, 6.6 y 6.7 de SAP Hybris Commerce."}], "lastModified": "2019-01-07T17:40:43.377", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:hybris:6.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77D0690C-687F-4D21-97C9-6AE1F00DBE0A"}, {"criteria": "cpe:2.3:a:sap:hybris:6.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A9C58B26-222E-47C6-AF6D-9F7DE48BB78F"}, {"criteria": "cpe:2.3:a:sap:hybris:6.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB842B1C-BFD7-43D8-88D4-ED677AC1470E"}, {"criteria": "cpe:2.3:a:sap:hybris:6.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "955A7DD3-972A-4E04-B27D-BD5AE3E27306"}, {"criteria": "cpe:2.3:a:sap:hybris:6.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C6C7DB50-EC03-4F30-847B-375122121886"}, {"criteria": "cpe:2.3:a:sap:hybris:6.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B7349C8-B134-41BC-A99E-5B2723E44EFA"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}