Skip links
RedRays
Arpine Maghakyan

Arpine Maghakyan

Security Researcher of RedRays.

Whitelist based Clickjacking Framing Protection in UI theme designer on SAP Portal, SAP security note 2358849

Description

UI theme designer on SAP Portal does not protect its applications against Clickjacking attacks.

Available fix and Supported packages

  • UISAPUI5_JAVA | 7.31 | 7.31
  • UISAPUI5_JAVA | 7.40 | 7.40
  • UISAPUI5_JAVA | 7.30 | 7.30
  • UISAPUI5_JAVA | 7.50 | 7.50
  • SAPUI5 CLIENT RT AS JAVA 7.30 | SP013 | 000026
  • SAPUI5 CLIENT RT AS JAVA 7.30 | SP014 | 000025
  • SAPUI5 CLIENT RT AS JAVA 7.30 | SP015 | 000010
  • SAPUI5 CLIENT RT AS JAVA 7.30 | SP016 | 000001
  • SAPUI5 CLIENT RT AS JAVA 7.30 | SP017 | 000000
  • SAPUI5 CLIENT RT AS JAVA 7.31 | SP016 | 000020
  • SAPUI5 CLIENT RT AS JAVA 7.31 | SP017 | 000025
  • SAPUI5 CLIENT RT AS JAVA 7.31 | SP018 | 000006
  • SAPUI5 CLIENT RT AS JAVA 7.31 | SP019 | 000000
  • SAPUI5 CLIENT RT AS JAVA 7.31 | SP020 | 000000
  • SAPUI5 CLIENT RT AS JAVA 7.40 | SP011 | 000019
  • SAPUI5 CLIENT RT AS JAVA 7.40 | SP012 | 000023
  • SAPUI5 CLIENT RT AS JAVA 7.40 | SP013 | 000006
  • SAPUI5 CLIENT RT AS JAVA 7.40 | SP014 | 000000
  • SAPUI5 CLIENT RT AS JAVA 7.40 | SP015 | 000000
  • SAPUI5 CLIENT RT AS JAVA 7.50 | SP002 | 000010
  • SAPUI5 CLIENT RT AS JAVA 7.50 | SP003 | 000014
  • SAPUI5 CLIENT RT AS JAVA 7.50 | SP004 | 000005
  • SAPUI5 CLIENT RT AS JAVA 7.50 | SP005 | 000000
  • SAPUI5 CLIENT RT AS JAVA 7.50 | SP006 | 000000

Affected component

    CA-UI2-THD
    Theme Designer

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/2358849

TAGS

#UI-redressing-attack
#Clickjacking
#Framing-Protection
#Framing
#IFrame
#UI-Redressing
#Clickjacking-Whitelist
#X-FRAME-OPTION

More to explorer