CVE-2018-2434
First published: Tue Jul 10 2018(Updated: )
A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which might fool an end user: UI add-on for SAP NetWeaver (UI_Infra, 1.0), SAP UI Implementation for Decoupled Innovations (UI_700, 2.0): SAP NetWeaver 7.00 Implementation, SAP User Interface Technology (SAP_UI 7.4, 7.5, 7.51, 7.52). There is little impact as it is not possible to embed active contents such as JavaScript or hyperlinks.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP NetWeaver | =7.0 | |
| Sap Ui Infra | =1.0 | |
| SAP User Interface Technology | =7.4 | |
| SAP User Interface Technology | =7.5 | |
| SAP User Interface Technology | =7.51 | |
| SAP User Interface Technology | =7.52 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-2434?
CVE-2018-2434 is a content spoofing vulnerability in certain SAP components that allows rendering of HTML pages containing arbitrary plain text content.
Which components are affected by CVE-2018-2434?
UI add-on for SAP NetWeaver (UI_Infra 1.0), SAP UI Implementation for Decoupled Innovations (UI_700 2.0), SAP NetWeaver 7.00 Implementation are affected by CVE-2018-2434.
What is the severity level of CVE-2018-2434?
CVE-2018-2434 has a severity level of medium with a CVSS score of 4.3.
How can I fix CVE-2018-2434?
To fix CVE-2018-2434, update the affected SAP components to the latest patched versions.
Where can I find more information about CVE-2018-2434?
You can find more information about CVE-2018-2434 on the following sources: [SecurityFocus](http://www.securityfocus.com/bid/105088), [SAP Note](https://launchpad.support.sap.com/#/notes/2633180), [SAP SCN Wiki](https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000).
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- vendor/sap
- canonical/sap netweaver
- version/sap netweaver/7.0
- canonical/sap ui infra
- version/sap ui infra/1.0
- canonical/sap user interface technology
- version/sap user interface technology/7.4
- version/sap user interface technology/7.5
- version/sap user interface technology/7.51
- version/sap user interface technology/7.52