6.1Medium
CVE-2026-0505Multiple vulnerabilities in BSP Applications of SAP Document Management System
Description
The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unvalidated redirection to attacker-controlled websites, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.
Weakness (CWE):
CWE-79
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| sap | document management system | 600 | |
| sap | erp | 618 | |
| sap | s4core | 102 | |
| SAP_SE | SAP Document Management System | SAP_APPL 618, S4CORE 102, 103, 104, 105, 106, 107, 108, 109, EA-APPL 600, 602, 603, 604, 605, 606, 617 |
References and patches
- https://me.sap.com/notes/3678417
- https://url.sap/sapsecuritypatchday Vendor Advisory
CPE matches (NVD) (15)
cpe:2.3:a:sap:document_management_system:600:*:*:*:*:*:*:*cpe:2.3:a:sap:document_management_system:602:*:*:*:*:*:*:*cpe:2.3:a:sap:document_management_system:603:*:*:*:*:*:*:*cpe:2.3:a:sap:document_management_system:604:*:*:*:*:*:*:*cpe:2.3:a:sap:document_management_system:605:*:*:*:*:*:*:*cpe:2.3:a:sap:document_management_system:606:*:*:*:*:*:*:*cpe:2.3:a:sap:document_management_system:617:*:*:*:*:*:*:*cpe:2.3:a:sap:erp:618:*:*:*:*:*:*:*cpe:2.3:a:sap:s4core:102:*:*:*:*:*:*:*cpe:2.3:a:sap:s4core:103:*:*:*:*:*:*:*cpe:2.3:a:sap:s4core:104:*:*:*:*:*:*:*cpe:2.3:a:sap:s4core:105:*:*:*:*:*:*:*cpe:2.3:a:sap:s4core:106:*:*:*:*:*:*:*cpe:2.3:a:sap:s4core:107:*:*:*:*:*:*:*cpe:2.3:a:sap:s4core:108:*:*:*:*:*:*:*