SAP J2EE Engine Core Unspecified Phishing Vulnerability

Bugtraq ID:	38183
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 11 2010 12:00AM
Updated:	Feb 19 2010 04:41PM
Credit:	Mariano Nuez Di Croce
Vulnerable:	SAP J2EE Engine Core 7.02 SAP J2EE Engine Core 7.01 SAP J2EE Engine Core 7.00 SP02 SAP J2EE Engine Core 7.00 SAP J2EE Engine Core 6.40
Not Vulnerable:	SAP J2EE Engine Core 7.02 SP03 SAP J2EE Engine Core 7.01 SP07 SAP J2EE Engine Core 7.00 SP22 SAP J2EE Engine Core 6.40 SP26

SAP J2EE Engine Core Unspecified Phishing Vulnerability

SAP J2EE Engine Core is prone to a vulnerability that can aid in phishing attacks.

Successful exploits may allow attackers to redirect victims to a malicious website, which may lead to other attacks.

Versions prior to the following are vulnerable:

J2EE Engine Core 6.40 SP26
J2EE Engine Core 7.00 SP22
J2EE Engine Core 7.01 SP07
J2EE Engine Core 7.02 SP03

Additional products that include the J2EE Engine Core may also be vulnerable.

SAP J2EE Engine Core Unspecified Phishing Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

SAP J2EE Engine Core Unspecified Phishing Vulnerability

Solution:
Updates are available. Please contact the vendor for more information.

SAP J2EE Engine Core Unspecified Phishing Vulnerability

References:

• SAP Homepage (SAP)
  
• [Onapsis Security Advisory 2010-004] SAP J2EE Authentication Phishing Vector (Onapsis Research Labs )
  
• Re: [Onapsis Security Advisory 2010-004] SAP J2EE Authentication Phishing Vector ([email protected])