SAP Solution Manager (Trace Analysis), version – 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attacker can enter a link to malicious site which could trick the user to enter credentials or download malicious software, as a parameter in the application URL and share it with the end user who could potentially become a victim of the attack.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26836
Reference (s):
- FULLDISC:20210614 Onapsis Security Advisory 2021-0005: SAP Solution Manager Open Redirect from Trace Analysis
- URL: http://seclists.org/fulldisclosure/2021/Jun/25
- http://packetstormsecurity.com/files/163136/SAP-Solution-Manager-7.2-ST-720-Open-Redirection.html
- https://launchpad.support.sap.com/#/notes/2938650
- URL: https://launchpad.support.sap.com/#/notes/2938650