Vulnerability-Lookup

CNVD-2020-65552

Vulnerability from cnvd - Published: 2020-11-23

Title

SAP Fiori Launchpad跨站脚本漏洞

Description

SAP Fiori是德国思爱普（SAP）公司的一套为SAP应用程序提供用户体验（UX）的设计系统，它为设计人员和开发人员提供了一套工具和指南，能够快速地开发适用于任何平台的应用，为创建者和用户提供一致、创新的体验。SAP Fiori Launchpad是SAP Fiori应用程序的入口（Shell），它为应用程序提供导航、个性化、嵌入式支持和应用程序配置等服务。 SAP Fiori Launchpad 750、751、752、753、754和755版本存在跨站脚本漏洞，该漏洞源于News tile 未足够编码用户输入控制，导致允许未经授权的攻击者可利用该漏洞使用News tile应用程序发送的恶意代码，到另一个终端用户(受害者)。

Severity

中

Patch Name

SAP Fiori Launchpad跨站脚本漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://launchpad.support.sap.com/#/notes/2984627

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-26825

Impacted products

Name
['SAP SAP Fiori Launchpad 750', 'SAP SAP Fiori Launchpad 751', 'SAP SAP Fiori Launchpad 752', 'SAP SAP Fiori Launchpad 753', 'SAP SAP Fiori Launchpad 754', 'SAP SAP Fiori Launchpad 755']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-26825",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-26825"
    }
  },
  "description": "SAP Fiori\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u5957\u4e3aSAP\u5e94\u7528\u7a0b\u5e8f\u63d0\u4f9b\u7528\u6237\u4f53\u9a8c\uff08UX\uff09\u7684\u8bbe\u8ba1\u7cfb\u7edf\uff0c\u5b83\u4e3a\u8bbe\u8ba1\u4eba\u5458\u548c\u5f00\u53d1\u4eba\u5458\u63d0\u4f9b\u4e86\u4e00\u5957\u5de5\u5177\u548c\u6307\u5357\uff0c\u80fd\u591f\u5feb\u901f\u5730\u5f00\u53d1\u9002\u7528\u4e8e\u4efb\u4f55\u5e73\u53f0\u7684\u5e94\u7528\uff0c\u4e3a\u521b\u5efa\u8005\u548c\u7528\u6237\u63d0\u4f9b\u4e00\u81f4\u3001\u521b\u65b0\u7684\u4f53\u9a8c\u3002SAP Fiori Launchpad\u662fSAP Fiori\u5e94\u7528\u7a0b\u5e8f\u7684\u5165\u53e3\uff08Shell\uff09\uff0c\u5b83\u4e3a\u5e94\u7528\u7a0b\u5e8f\u63d0\u4f9b\u5bfc\u822a\u3001\u4e2a\u6027\u5316\u3001\u5d4c\u5165\u5f0f\u652f\u6301\u548c\u5e94\u7528\u7a0b\u5e8f\u914d\u7f6e\u7b49\u670d\u52a1\u3002\n\nSAP Fiori Launchpad 750\u3001751\u3001752\u3001753\u3001754\u548c755\u7248\u672c\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eNews tile \u672a\u8db3\u591f\u7f16\u7801\u7528\u6237\u8f93\u5165\u63a7\u5236\uff0c\u5bfc\u81f4\u5141\u8bb8\u672a\u7ecf\u6388\u6743\u7684\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4f7f\u7528News tile\u5e94\u7528\u7a0b\u5e8f\u53d1\u9001\u7684\u6076\u610f\u4ee3\u7801\uff0c\u5230\u53e6\u4e00\u4e2a\u7ec8\u7aef\u7528\u6237(\u53d7\u5bb3\u8005)\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://launchpad.support.sap.com/#/notes/2984627",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-65552",
  "openTime": "2020-11-23",
  "patchDescription": "SAP Fiori\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u5957\u4e3aSAP\u5e94\u7528\u7a0b\u5e8f\u63d0\u4f9b\u7528\u6237\u4f53\u9a8c\uff08UX\uff09\u7684\u8bbe\u8ba1\u7cfb\u7edf\uff0c\u5b83\u4e3a\u8bbe\u8ba1\u4eba\u5458\u548c\u5f00\u53d1\u4eba\u5458\u63d0\u4f9b\u4e86\u4e00\u5957\u5de5\u5177\u548c\u6307\u5357\uff0c\u80fd\u591f\u5feb\u901f\u5730\u5f00\u53d1\u9002\u7528\u4e8e\u4efb\u4f55\u5e73\u53f0\u7684\u5e94\u7528\uff0c\u4e3a\u521b\u5efa\u8005\u548c\u7528\u6237\u63d0\u4f9b\u4e00\u81f4\u3001\u521b\u65b0\u7684\u4f53\u9a8c\u3002SAP Fiori Launchpad\u662fSAP Fiori\u5e94\u7528\u7a0b\u5e8f\u7684\u5165\u53e3\uff08Shell\uff09\uff0c\u5b83\u4e3a\u5e94\u7528\u7a0b\u5e8f\u63d0\u4f9b\u5bfc\u822a\u3001\u4e2a\u6027\u5316\u3001\u5d4c\u5165\u5f0f\u652f\u6301\u548c\u5e94\u7528\u7a0b\u5e8f\u914d\u7f6e\u7b49\u670d\u52a1\u3002\r\n\r\nSAP Fiori Launchpad 750\u3001751\u3001752\u3001753\u3001754\u548c755\u7248\u672c\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eNews tile \u672a\u8db3\u591f\u7f16\u7801\u7528\u6237\u8f93\u5165\u63a7\u5236\uff0c\u5bfc\u81f4\u5141\u8bb8\u672a\u7ecf\u6388\u6743\u7684\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4f7f\u7528News tile\u5e94\u7528\u7a0b\u5e8f\u53d1\u9001\u7684\u6076\u610f\u4ee3\u7801\uff0c\u5230\u53e6\u4e00\u4e2a\u7ec8\u7aef\u7528\u6237(\u53d7\u5bb3\u8005)\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "SAP Fiori Launchpad\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "SAP SAP Fiori Launchpad 750",
      "SAP SAP Fiori Launchpad 751",
      "SAP SAP Fiori Launchpad 752",
      "SAP SAP Fiori Launchpad 753",
      "SAP SAP Fiori Launchpad 754",
      "SAP SAP Fiori Launchpad 755"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-26825",
  "serverity": "\u4e2d",
  "submitTime": "2020-11-16",
  "title": "SAP Fiori Launchpad\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}

CVE-2020-26825 (GCVE-0-2020-26825)

Vulnerability from cvelistv5 – Published: 2020-11-13 14:28 – Updated: 2024-08-04 16:03

Summary

SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user (victim), because News tile does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. Information maintained in the victim's web browser can be read, modified, and sent to the attacker. The malicious code cannot significantly impact the victim's browser and the victim can easily close the browser tab to terminate it.

Severity

6.1 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

Reflected Cross Site Scripting

Assigner

sap mitre root

References

2 references

URL	Tags
https://wiki.scn.sap.com/wiki/pages/viewpage.acti…	x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2984627	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
SAP SE	SAP Fiori Launchpad (News Tile Application)	Affected: < 750 Affected: < 751 Affected: < 752 Affected: < 753 Affected: < 754 Affected: < 755

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:03:22.699Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/2984627"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAP Fiori Launchpad (News Tile Application)",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 750"
            },
            {
              "status": "affected",
              "version": "\u003c 751"
            },
            {
              "status": "affected",
              "version": "\u003c 752"
            },
            {
              "status": "affected",
              "version": "\u003c 753"
            },
            {
              "status": "affected",
              "version": "\u003c 754"
            },
            {
              "status": "affected",
              "version": "\u003c 755"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user (victim), because News tile does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. Information maintained in the victim\u0027s web browser can be read, modified, and sent to the attacker. The malicious code cannot significantly impact the victim\u0027s browser and the victim can easily close the browser tab to terminate it."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Reflected Cross Site Scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-13T14:28:00.000Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/2984627"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2020-26825",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP Fiori Launchpad (News Tile Application)",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "\u003c",
                            "version_value": "750"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "751"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "752"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "753"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "754"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "755"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP SE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user (victim), because News tile does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. Information maintained in the victim\u0027s web browser can be read, modified, and sent to the attacker. The malicious code cannot significantly impact the victim\u0027s browser and the victim can easily close the browser tab to terminate it."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "6.1",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Reflected Cross Site Scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571",
              "refsource": "MISC",
              "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/2984627",
              "refsource": "MISC",
              "url": "https://launchpad.support.sap.com/#/notes/2984627"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2020-26825",
    "datePublished": "2020-11-13T14:28:00.000Z",
    "dateReserved": "2020-10-07T00:00:00.000Z",
    "dateUpdated": "2024-08-04T16:03:22.699Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.