Skip links
RedRays
Published in: sap note

CVE-2020-6365 Reverse Tabnabbing vulnerability in SAP NetWeaver AS Java Start Page, SAP security note 2965315

Author
Published on:

Description

SAP NetWeaver AS Java Start Page allows an unauthenticated remote attacker to redirect users to a malicious site due to insufficient reverse tabnabbing URL validation. The attacker could execute phishing attacks to steal credentials of the victim or to redirect users to untrusted web pages containing malware or similar malicious exploits.                                                                                    

Available fix and Supported packages

  • J2EE-APPS | 7.10 | 7.11
  • J2EE-APPS | 7.20 | 7.20
  • J2EE-APPS | 7.30 | 7.30
  • J2EE-APPS | 7.31 | 7.31
  • J2EE-APPS | 7.40 | 7.40
  • J2EE-APPS | 7.50 | 7.50
  • J2EE ENGINE APPLICATIONS 7.10 | SP023 | 000006
  • J2EE ENGINE APPLICATIONS 7.10 | SP024 | 000006
  • J2EE ENGINE APPLICATIONS 7.10 | SP025 | 000001
  • J2EE ENGINE APPLICATIONS 7.11 | SP018 | 000005
  • J2EE ENGINE APPLICATIONS 7.11 | SP019 | 000005
  • J2EE ENGINE APPLICATIONS 7.11 | SP020 | 000001
  • J2EE ENGINE APPLICATIONS 7.20 | SP009 | 000033
  • J2EE ENGINE APPLICATIONS 7.30 | SP019 | 000006
  • J2EE ENGINE APPLICATIONS 7.30 | SP020 | 000002
  • J2EE ENGINE APPLICATIONS 7.30 | SP021 | 000000
  • J2EE ENGINE APPLICATIONS 7.31 | SP023 | 000012
  • J2EE ENGINE APPLICATIONS 7.31 | SP024 | 000009
  • J2EE ENGINE APPLICATIONS 7.31 | SP025 | 000009
  • J2EE ENGINE APPLICATIONS 7.31 | SP026 | 000003
  • J2EE ENGINE APPLICATIONS 7.31 | SP027 | 000001
  • J2EE ENGINE APPLICATIONS 7.31 | SP028 | 000000
  • J2EE ENGINE APPLICATIONS 7.40 | SP018 | 000012
  • J2EE ENGINE APPLICATIONS 7.40 | SP019 | 000009
  • J2EE ENGINE APPLICATIONS 7.40 | SP020 | 000009
  • J2EE ENGINE APPLICATIONS 7.40 | SP021 | 000003

Affected component

    BC-JAS-ADM-ADM
    Administration

CVSS

Score: 4.7
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/2965315

TAGS

#Open-redirect
#startPage
#reverse-tabnabbing
#cross-site-redirect
#cross-domain-redirect
#&160-CVE-2020-6365

You may also like