Lucene search

[email protected]CVE-2018-2440

HistoryJul 10, 2018 - 6:29 p.m.

CVE-2018-2440

2018-07-1018:29:00

CWE-532

[email protected]

web.nvd.nist.gov

cve-2018-2440

sap

dam

nextlabs

java

policy controller

information security

4.4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

6.7 Medium

AI Score

Confidence

Low

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

12.3%

JSON

Under certain circumstances SAP Dynamic Authorization Management (DAM) by NextLabs (Java Policy Controller versions 7.7 and 8.5) exposes sensitive information in the application logs.

CPENameOperatorVersion
sap:dynamic_authorization_managementsap dynamic authorization managementeq8.5
sap:dynamic_authorization_managementsap dynamic authorization managementeq7.7

CPE	Name	Operator	Version
sap:dynamic_authorization_management	sap dynamic authorization management	eq	8.5
sap:dynamic_authorization_management	sap dynamic authorization management	eq	7.7

References

launchpad.support.sap.com/#/notes/2664767

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000

4.4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

6.7 Medium

AI Score

Confidence

Low

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

12.3%

JSON

Related for CVE-2018-2440

cvelist1 prion1