CVE-2025-24868

The User Account and Authentication service (UAA) for SAP HANA extended application services, advanced model (SAP HANA XS advanced model) allows an unauthenticated attacker to craft a malicious link, that, when clicked by a victim, redirects the browser to a malicious site due to insufficient redirect URL validation. On successful exploitation attacker can cause limited impact on confidentiality, integrity, and availability of the system.

Score
CVSS 3.1 7.1 High
Status
Deferred - cna@sap.com
Published
2025-02-11
Last modified
2025-02-11
Weaknesses
CWE-601

Affected products

References

 
 
© AVABIS GmbH privacypolicy about