Vulnerability-Lookup

CVE-2026-0505 (GCVE-0-2026-0505)

Vulnerability from cvelistv5 – Published: 2026-02-10 03:01 – Updated: 2026-02-10 16:28

Title

Multiple vulnerabilities in BSP Applications of SAP Document Management System

Summary

The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unvalidated redirection to attacker-controlled websites, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-10 16:28 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation

Assigner

sap CNA under the mitre root

CNA scorecard C 65/100 over 117 records in the last 180 days details

References

2 references

URL	Tags
https://me.sap.com/notes/3678417
https://url.sap/sapsecuritypatchday

Impacted products

1 product

Vendor	Product	Version	CPE status
SAP_SE	SAP Document Management System	Affected: SAP_APPL 618 Affected: S4CORE 102 Affected: 103 Affected: 104 Affected: 105 Affected: 106 Affected: 107 Affected: 108 Affected: 109 Affected: EA-APPL 600 Affected: 602 Affected: 603 Affected: 604 Affected: 605 Affected: 606 Affected: 617	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0505",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-10T16:28:21.921328Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-10T16:28:31.245Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP Document Management System",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_APPL 618"
            },
            {
              "status": "affected",
              "version": "S4CORE 102"
            },
            {
              "status": "affected",
              "version": "103"
            },
            {
              "status": "affected",
              "version": "104"
            },
            {
              "status": "affected",
              "version": "105"
            },
            {
              "status": "affected",
              "version": "106"
            },
            {
              "status": "affected",
              "version": "107"
            },
            {
              "status": "affected",
              "version": "108"
            },
            {
              "status": "affected",
              "version": "109"
            },
            {
              "status": "affected",
              "version": "EA-APPL 600"
            },
            {
              "status": "affected",
              "version": "602"
            },
            {
              "status": "affected",
              "version": "603"
            },
            {
              "status": "affected",
              "version": "604"
            },
            {
              "status": "affected",
              "version": "605"
            },
            {
              "status": "affected",
              "version": "606"
            },
            {
              "status": "affected",
              "version": "617"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unvalidated redirection to attacker-controlled websites, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.\u003c/p\u003e"
            }
          ],
          "value": "The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unvalidated redirection to attacker-controlled websites, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation",
              "lang": "eng",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-10T03:01:30.818Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3678417"
        },
        {
          "url": "https://url.sap/sapsecuritypatchday"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Multiple vulnerabilities in BSP Applications of SAP Document Management System",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2026-0505",
    "datePublished": "2026-02-10T03:01:30.818Z",
    "dateReserved": "2025-12-09T22:06:45.302Z",
    "dateUpdated": "2026-02-10T16:28:31.245Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-0505",
      "date": "2026-10-21",
      "epss": "0.00244",
      "percentile": "0.14685"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "SAP Document Management System",
                "vendor": "SAP_SE",
                "versions": [
                  {
                    "status": "affected",
                    "version": "SAP_APPL 618"
                  },
                  {
                    "status": "affected",
                    "version": "S4CORE 102"
                  },
                  {
                    "status": "affected",
                    "version": "103"
                  },
                  {
                    "status": "affected",
                    "version": "104"
                  },
                  {
                    "status": "affected",
                    "version": "105"
                  },
                  {
                    "status": "affected",
                    "version": "106"
                  },
                  {
                    "status": "affected",
                    "version": "107"
                  },
                  {
                    "status": "affected",
                    "version": "108"
                  },
                  {
                    "status": "affected",
                    "version": "109"
                  },
                  {
                    "status": "affected",
                    "version": "EA-APPL 600"
                  },
                  {
                    "status": "affected",
                    "version": "602"
                  },
                  {
                    "status": "affected",
                    "version": "603"
                  },
                  {
                    "status": "affected",
                    "version": "604"
                  },
                  {
                    "status": "affected",
                    "version": "605"
                  },
                  {
                    "status": "affected",
                    "version": "606"
                  },
                  {
                    "status": "affected",
                    "version": "617"
                  }
                ]
              }
            ],
            "source": "cna@sap.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:sap:document_management_system:600:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FD522469-1153-4A3C-9271-2338A5674BDA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:document_management_system:602:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D355E922-5592-41C7-ACE4-311044B9E8C3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:document_management_system:603:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1E8A41C8-812E-4319-B515-CF9F030DAA19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:document_management_system:604:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4B470B7D-486C-43B0-B9B0-AC0A16034A01",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:document_management_system:605:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0024390E-91C7-48B5-8E04-265E9E6D4E75",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:document_management_system:606:*:*:*:*:*:*:*",
                    "matchCriteriaId": "133C3E0D-2D67-479A-A678-07EB04244BCB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:document_management_system:617:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D7E1D717-FA00-47D5-94B6-E818848890C6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:erp:618:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4573BD22-D50B-431E-928A-C495E342D1AE",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:s4core:102:*:*:*:*:*:*:*",
                    "matchCriteriaId": "04C95A73-48EB-446C-A5F0-20E1D6BC1779",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:s4core:103:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1C3C9003-68A6-4886-8979-9B7D01A35E40",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:s4core:104:*:*:*:*:*:*:*",
                    "matchCriteriaId": "964023CE-6EA4-42BB-93B2-DCE6B36D3F89",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:s4core:105:*:*:*:*:*:*:*",
                    "matchCriteriaId": "84B775EF-6C11-4FAB-B5E7-8F6C4C5674BE",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:s4core:106:*:*:*:*:*:*:*",
                    "matchCriteriaId": "14D17245-5B6D-4024-AFA6-8E0A70B294BF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:s4core:107:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5DEFABE8-1797-4C7B-941C-3205AE90914B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:s4core:108:*:*:*:*:*:*:*",
                    "matchCriteriaId": "78832FB6-B1DD-4516-B1DF-D90BB58BF25A",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unvalidated redirection to attacker-controlled websites, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application."
          },
          {
            "lang": "es",
            "value": "Las aplicaciones BSP permiten a un usuario no autenticado manipular par\u00e1metros URL controlados por el usuario que no est\u00e1n suficientemente validados. Esto podr\u00eda resultar en una redirecci\u00f3n no validada a sitios web controlados por el atacante, lo que conlleva un impacto bajo en la confidencialidad y la integridad, y ning\u00fan impacto en la disponibilidad de la aplicaci\u00f3n."
          }
        ],
        "id": "CVE-2026-0505",
        "lastModified": "2026-06-17T10:10:51.683",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "cna@sap.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-0505",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-10T16:28:21.921328Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-02-10T04:16:02.030",
        "references": [
          {
            "source": "cna@sap.com",
            "tags": [
              "Permissions Required"
            ],
            "url": "https://me.sap.com/notes/3678417"
          },
          {
            "source": "cna@sap.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://url.sap/sapsecuritypatchday"
          }
        ],
        "sourceIdentifier": "cna@sap.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "cna@sap.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-02-11T07:30:33+00:00",
      "cve": "CVE-2026-0505",
      "id": "CVE-2026-0505",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Multiple vulnerabilities in BSP Applications of SAP Document Management System",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0505.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-0505",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-02-10T16:28:21.921328Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-02-10T16:28:27.821Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "SAP Document Management System",
              "vendor": "SAP_SE",
              "versions": [
                {
                  "status": "affected",
                  "version": "SAP_APPL 618"
                },
                {
                  "status": "affected",
                  "version": "S4CORE 102"
                },
                {
                  "status": "affected",
                  "version": "103"
                },
                {
                  "status": "affected",
                  "version": "104"
                },
                {
                  "status": "affected",
                  "version": "105"
                },
                {
                  "status": "affected",
                  "version": "106"
                },
                {
                  "status": "affected",
                  "version": "107"
                },
                {
                  "status": "affected",
                  "version": "108"
                },
                {
                  "status": "affected",
                  "version": "109"
                },
                {
                  "status": "affected",
                  "version": "EA-APPL 600"
                },
                {
                  "status": "affected",
                  "version": "602"
                },
                {
                  "status": "affected",
                  "version": "603"
                },
                {
                  "status": "affected",
                  "version": "604"
                },
                {
                  "status": "affected",
                  "version": "605"
                },
                {
                  "status": "affected",
                  "version": "606"
                },
                {
                  "status": "affected",
                  "version": "617"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eThe BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unvalidated redirection to attacker-controlled websites, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.\u003c/p\u003e"
                }
              ],
              "value": "The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unvalidated redirection to attacker-controlled websites, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation",
                  "lang": "eng",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-02-10T03:01:30.818Z",
            "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
            "shortName": "sap"
          },
          "references": [
            {
              "url": "https://me.sap.com/notes/3678417"
            },
            {
              "url": "https://url.sap/sapsecuritypatchday"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Multiple vulnerabilities in BSP Applications of SAP Document Management System",
          "x_generator": {
            "engine": "Vulnogram 0.5.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "assignerShortName": "sap",
        "cveId": "CVE-2026-0505",
        "datePublished": "2026-02-10T03:01:30.818Z",
        "dateReserved": "2025-12-09T22:06:45.302Z",
        "dateUpdated": "2026-02-10T16:28:31.245Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0141

Vulnerability from certfr_avis - Published: 2026-02-10 - Updated: 2026-02-10

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
SAP	S/4HANA	S/4HANA Defense & Security (Disconnected Operations) versions EA-DFPS 600, 603, 604, 605, 606, 616, 617, 618, 619, 800, 801, 802, 803, 804, 805, 806, 807, 808 et 809 sans le dernier correctif de sécurité
SAP	Business Objects Business Intelligence Platform	BusinessObjects Business Intelligence Platform (AdminTools) versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de sécurité
SAP	Business Objects Business Intelligence Platform	BusinessObjects BI Platform versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de sécurité
SAP	Business Objects Business Intelligence Platform	BusinessObjects Business Intelligence Platform versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de sécurité
SAP	N/A	Support Tools Plug-In versions ST-PI 2008_1_700, 2008_1_710, 740 et 758 sans le dernier correctif de sécurité
SAP	NetWeaver et ABAP	NetWeaver (JMS service) version J2EE-FRMW 7.50 sans le dernier correctif de sécurité
SAP	NetWeaver et ABAP	ABAP based systems versions ST-PI 2005_1_700, 2008_1_710, 740 et 758 sans le dernier correctif de sécurité
SAP	N/A	Document Management System versions SAP_APPL 618, S4CORE 102, 103, 104, 105, 106, 107, 108, 109, EA-APPL 600, 602, 603, 604, 605, 606 et 617 sans le dernier correctif de sécurité
SAP	NetWeaver et ABAP	NetWeaver AS ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 804, SAP_BASIS 916, SAP_BASIS 917 et SAP_BASIS 918 sans le dernier correctif de sécurité
SAP	S/4HANA	CRM et S/4HANA (Scripting Editor) versions S4FND 102, 103, 104, 105, 106, 107, 108, 109, SAP_ABA 700, WEBCUIF 700, 701, 730, 731, 746, 747, 748, 800 et 801 sans le dernier correctif de sécurité
SAP	Business One (SLD)	Business One (B1 Client Memory Dump Files) versions B1_ON_HANA 10.0 et SAP-M-BO 10.0 sans le dernier correctif de sécurité
SAP	N/A	Supply Chain Management versions SCMAPO 713, 714, SCM 700, 701, 702 et 712 sans le dernier correctif de sécurité
SAP	Fiori App	Fiori App (Manage Service Entry Sheets - Lean Services) versions S4CORE 102, 103, 104, 105, 106 et 107 sans le dernier correctif de sécurité
SAP	N/A	Business Workflow versions SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de sécurité
SAP	NetWeaver et ABAP	NetWeaver Application Server ABAP and S/4HANA versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de sécurité
SAP	N/A	Business Server Pages Application (TAF_APPLAUNCHER) versions ST-PI 2008_1_700, 2008_1_710, 740 et 758 sans le dernier correctif de sécurité
SAP	Commerce Cloud	Commerce Cloud versions HY_COM 2205, COM_CLOUD 2211 et 2211-JDK21 sans le dernier correctif de sécurité
SAP	NetWeaver et ABAP	NetWeaver and ABAP Platform (Application Server ABAP) versions [KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.17 et 9.18] sans le dernier correctif de sécurité
SAP	Commerce Cloud	Commerce Cloud versions HY_COM 2205, COM_CLOUD 2211 et COM_CLOUD 2211-JDK21 sans le dernier correctif de sécurité
SAP	NetWeaver et ABAP	NetWeaver Application Server ABAP and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18 et 9.19 sans le dernier correctif de sécurité
SAP	N/A	Solution Tools Plug-In (ST-PI) versions ST-PI 2008_1_700, 2008_1_710, 740 et 758 sans le dernier correctif de sécurité
SAP	N/A	BusinessObjects Enterprise (Central Management Console) versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de sécurité
SAP	N/A	Strategic Enterprise Management (Balanced Scorecard in BSP Application) versions SEM-BW 600, 700, 602, 603, 604, 605, 634, 736, 746, 747, 748 et 800 sans le dernier correctif de sécurité
SAP	NetWeaver et ABAP	NetWeaver Application Server ABAP (applications based on GUI for HTML) versions KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93, 9.12 et 9.14 sans le dernier correctif de sécurité
SAP	NetWeaver et ABAP	NetWeaver Application Server Java version LMNWABASICAPPS 7.50 sans le dernier correctif de sécurité

References

Title

Publication Time

Tags

Bulletin de sécurité SAP february-2026

2026-02-10

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "S/4HANA Defense \u0026 Security (Disconnected Operations) versions EA-DFPS 600, 603, 604, 605, 606, 616, 617, 618, 619, 800, 801, 802, 803, 804, 805, 806, 807, 808 et 809 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "S/4HANA",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "BusinessObjects Business Intelligence Platform (AdminTools) versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Business Objects Business Intelligence Platform",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "BusinessObjects BI Platform versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Business Objects Business Intelligence Platform",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Business Objects Business Intelligence Platform",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Support Tools Plug-In versions ST-PI 2008_1_700, 2008_1_710, 740 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver (JMS service) version J2EE-FRMW 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver et ABAP",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "ABAP based systems versions ST-PI 2005_1_700, 2008_1_710, 740 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver et ABAP",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Document Management System versions SAP_APPL 618, S4CORE 102, 103, 104, 105, 106, 107, 108, 109, EA-APPL 600, 602, 603, 604, 605, 606 et 617 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver AS ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 804, SAP_BASIS 916, SAP_BASIS 917 et SAP_BASIS 918 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver et ABAP",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "CRM et S/4HANA (Scripting Editor) versions S4FND 102, 103, 104, 105, 106, 107, 108, 109, SAP_ABA 700, WEBCUIF 700, 701, 730, 731, 746, 747, 748, 800 et 801 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "S/4HANA",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Business One (B1 Client Memory Dump Files) versions B1_ON_HANA 10.0 et SAP-M-BO 10.0 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Business One (SLD)",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Supply Chain Management versions SCMAPO 713, 714, SCM 700, 701, 702 et 712 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Fiori App (Manage Service Entry Sheets - Lean Services) versions S4CORE 102, 103, 104, 105, 106 et 107 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Fiori App",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Business Workflow versions SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Application Server ABAP and S/4HANA versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver et ABAP",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Business Server Pages Application (TAF_APPLAUNCHER) versions ST-PI 2008_1_700, 2008_1_710, 740 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Commerce Cloud versions HY_COM 2205, COM_CLOUD 2211 et 2211-JDK21 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Commerce Cloud",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver and ABAP Platform (Application Server ABAP) versions [KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.17 et 9.18] sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver et ABAP",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Commerce Cloud versions HY_COM 2205, COM_CLOUD 2211 et COM_CLOUD 2211-JDK21 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Commerce Cloud",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Application Server ABAP and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18 et 9.19 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver et ABAP",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Solution Tools Plug-In (ST-PI) versions ST-PI 2008_1_700, 2008_1_710, 740 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "BusinessObjects Enterprise (Central Management Console) versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Strategic Enterprise Management (Balanced Scorecard in BSP Application) versions SEM-BW 600, 700, 602, 603, 604, 605, 634, 736, 746, 747, 748 et 800 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Application Server ABAP (applications based on GUI for HTML) versions KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93, 9.12 et 9.14 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver et ABAP",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Application Server Java version LMNWABASICAPPS 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver et ABAP",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-23681",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23681"
    },
    {
      "name": "CVE-2026-24326",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24326"
    },
    {
      "name": "CVE-2026-24320",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24320"
    },
    {
      "name": "CVE-2026-23688",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23688"
    },
    {
      "name": "CVE-2026-24319",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24319"
    },
    {
      "name": "CVE-2026-24321",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24321"
    },
    {
      "name": "CVE-2026-0485",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-0485"
    },
    {
      "name": "CVE-2026-24324",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24324"
    },
    {
      "name": "CVE-2026-0509",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-0509"
    },
    {
      "name": "CVE-2026-0508",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-0508"
    },
    {
      "name": "CVE-2025-12383",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-12383"
    },
    {
      "name": "CVE-2026-24312",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24312"
    },
    {
      "name": "CVE-2026-0486",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-0486"
    },
    {
      "name": "CVE-2026-23684",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23684"
    },
    {
      "name": "CVE-2025-0059",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0059"
    },
    {
      "name": "CVE-2026-23689",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23689"
    },
    {
      "name": "CVE-2026-0484",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-0484"
    },
    {
      "name": "CVE-2026-24325",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24325"
    },
    {
      "name": "CVE-2026-0488",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-0488"
    },
    {
      "name": "CVE-2026-0490",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-0490"
    },
    {
      "name": "CVE-2026-23687",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23687"
    },
    {
      "name": "CVE-2026-24322",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24322"
    },
    {
      "name": "CVE-2026-23686",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23686"
    },
    {
      "name": "CVE-2026-23685",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23685"
    },
    {
      "name": "CVE-2026-24323",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24323"
    },
    {
      "name": "CVE-2026-0505",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-0505"
    },
    {
      "name": "CVE-2026-24328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24328"
    },
    {
      "name": "CVE-2026-24327",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24327"
    }
  ],
  "initial_release_date": "2026-02-10T00:00:00",
  "last_revision_date": "2026-02-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0141",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-02-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
  "vendor_advisories": [
    {
      "published_at": "2026-02-10",
      "title": "Bulletin de s\u00e9curit\u00e9 SAP february-2026",
      "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/february-2026.html"
    }
  ]
}

FKIE_CVE-2026-0505

Vulnerability from fkie_nvd - Published: 2026-02-10 04:16 - Updated: 2026-06-17 10:10

Severity

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

	URL	Tags
	cna@sap.com	https://me.sap.com/notes/3678417	Permissions Required
	cna@sap.com	https://url.sap/sapsecuritypatchday	Vendor Advisory

Impacted products

Vendor	Product	Version
sap	document_management_system	600
sap	document_management_system	602
sap	document_management_system	603
sap	document_management_system	604
sap	document_management_system	605
sap	document_management_system	606
sap	document_management_system	617
sap	erp	618
sap	s4core	102
sap	s4core	103
sap	s4core	104
sap	s4core	105
sap	s4core	106
sap	s4core	107
sap	s4core	108

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP Document Management System",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_APPL 618"
            },
            {
              "status": "affected",
              "version": "S4CORE 102"
            },
            {
              "status": "affected",
              "version": "103"
            },
            {
              "status": "affected",
              "version": "104"
            },
            {
              "status": "affected",
              "version": "105"
            },
            {
              "status": "affected",
              "version": "106"
            },
            {
              "status": "affected",
              "version": "107"
            },
            {
              "status": "affected",
              "version": "108"
            },
            {
              "status": "affected",
              "version": "109"
            },
            {
              "status": "affected",
              "version": "EA-APPL 600"
            },
            {
              "status": "affected",
              "version": "602"
            },
            {
              "status": "affected",
              "version": "603"
            },
            {
              "status": "affected",
              "version": "604"
            },
            {
              "status": "affected",
              "version": "605"
            },
            {
              "status": "affected",
              "version": "606"
            },
            {
              "status": "affected",
              "version": "617"
            }
          ]
        }
      ],
      "source": "cna@sap.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:document_management_system:600:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD522469-1153-4A3C-9271-2338A5674BDA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:document_management_system:602:*:*:*:*:*:*:*",
              "matchCriteriaId": "D355E922-5592-41C7-ACE4-311044B9E8C3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:document_management_system:603:*:*:*:*:*:*:*",
              "matchCriteriaId": "1E8A41C8-812E-4319-B515-CF9F030DAA19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:document_management_system:604:*:*:*:*:*:*:*",
              "matchCriteriaId": "4B470B7D-486C-43B0-B9B0-AC0A16034A01",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:document_management_system:605:*:*:*:*:*:*:*",
              "matchCriteriaId": "0024390E-91C7-48B5-8E04-265E9E6D4E75",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:document_management_system:606:*:*:*:*:*:*:*",
              "matchCriteriaId": "133C3E0D-2D67-479A-A678-07EB04244BCB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:document_management_system:617:*:*:*:*:*:*:*",
              "matchCriteriaId": "D7E1D717-FA00-47D5-94B6-E818848890C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:erp:618:*:*:*:*:*:*:*",
              "matchCriteriaId": "4573BD22-D50B-431E-928A-C495E342D1AE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:102:*:*:*:*:*:*:*",
              "matchCriteriaId": "04C95A73-48EB-446C-A5F0-20E1D6BC1779",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:103:*:*:*:*:*:*:*",
              "matchCriteriaId": "1C3C9003-68A6-4886-8979-9B7D01A35E40",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:104:*:*:*:*:*:*:*",
              "matchCriteriaId": "964023CE-6EA4-42BB-93B2-DCE6B36D3F89",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:105:*:*:*:*:*:*:*",
              "matchCriteriaId": "84B775EF-6C11-4FAB-B5E7-8F6C4C5674BE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:106:*:*:*:*:*:*:*",
              "matchCriteriaId": "14D17245-5B6D-4024-AFA6-8E0A70B294BF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:107:*:*:*:*:*:*:*",
              "matchCriteriaId": "5DEFABE8-1797-4C7B-941C-3205AE90914B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:108:*:*:*:*:*:*:*",
              "matchCriteriaId": "78832FB6-B1DD-4516-B1DF-D90BB58BF25A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unvalidated redirection to attacker-controlled websites, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application."
    },
    {
      "lang": "es",
      "value": "Las aplicaciones BSP permiten a un usuario no autenticado manipular par\u00e1metros URL controlados por el usuario que no est\u00e1n suficientemente validados. Esto podr\u00eda resultar en una redirecci\u00f3n no validada a sitios web controlados por el atacante, lo que conlleva un impacto bajo en la confidencialidad y la integridad, y ning\u00fan impacto en la disponibilidad de la aplicaci\u00f3n."
    }
  ],
  "id": "CVE-2026-0505",
  "lastModified": "2026-06-17T10:10:51.683",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "cna@sap.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-0505",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-02-10T16:28:21.921328Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-02-10T04:16:02.030",
  "references": [
    {
      "source": "cna@sap.com",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://me.sap.com/notes/3678417"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "cna@sap.com",
      "type": "Secondary"
    }
  ]
}

GHSA-8GRJ-8RRM-8934

Vulnerability from github – Published: 2026-02-10 06:30 – Updated: 2026-02-10 06:30

Details

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-0505"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-10T04:16:02Z",
    "severity": "MODERATE"
  },
  "details": "The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unvalidated redirection to attacker-controlled websites, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.",
  "id": "GHSA-8grj-8rrm-8934",
  "modified": "2026-02-10T06:30:38Z",
  "published": "2026-02-10T06:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0505"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3678417"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

NCSC-2026-0052

Vulnerability from csaf_ncscnl - Published: 2026-02-10 12:28 - Updated: 2026-02-10 12:28

Summary

Kwetsbaarheden verholpen in SAP producten

Scope

28 vulnerabilities in this advisory, including CVE-2026-0505.

CVE-2026-0505

The BSP applications in the SAP Document Management System have vulnerabilities allowing unauthenticated users to manipulate URL parameters, leading to potential unvalidated redirection to malicious sites.

6.1 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Known affected: 23 products

Open the full advisory

WID-SEC-W-2026-0354

Vulnerability from csaf_certbund - Published: 2026-02-09 23:00 - Updated: 2026-02-09 23:00

Summary

SAP Patchday Februar 2026: Mehrere Schwachstellen

Severity

Hoch

Scope

28 vulnerabilities in this advisory, including CVE-2026-0505.

CVE-2026-0505

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-0505 (GCVE-0-2026-0505)

CERTFR-2026-AVI-0141

Solutions

FKIE_CVE-2026-0505

GHSA-8GRJ-8RRM-8934

NCSC-2026-0052

WID-SEC-W-2026-0354

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour