Lucene search

[email protected]CVE-2018-2484

HistoryJan 08, 2019 - 8:29 p.m.

CVE-2018-2484

2019-01-0820:29:00

CWE-862

[email protected]

web.nvd.nist.gov

cve-2018-2484

sap

enterprise

financial services

authorization

escalation

privileges

nvd

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.5%

JSON

SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0; Bank/CFM 4.63_20) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Affected configurations

NVD

Node

sapsapscoreMatch1.13

sapsapscoreMatch1.14

sapsapscoreMatch1.15

Node

saps4coreMatch1.01

saps4coreMatch1.02

saps4coreMatch1.03

Node

sapea-finservMatch1.10

sapea-finservMatch2.0

sapea-finservMatch5.0

sapea-finservMatch6.0

sapea-finservMatch6.03

sapea-finservMatch6.04

sapea-finservMatch6.05

sapea-finservMatch6.06

sapea-finservMatch6.16

sapea-finservMatch6.17

sapea-finservMatch6.18

sapea-finservMatch8.0

Node

sapbank\/cfmMatch4.63_20

CPENameOperatorVersion
sap:sapscoresap sapscoreeq1.13
sap:sapscoresap sapscoreeq1.14
sap:sapscoresap sapscoreeq1.15

CPE	Name	Operator	Version
sap:sapscore	sap sapscore	eq	1.13
sap:sapscore	sap sapscore	eq	1.14
sap:sapscore	sap sapscore	eq	1.15

CNA Affected

[
  {
    "product": "SAP Enterprise Financial Services (SAPSCORE)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.13"
      },
      {
        "status": "affected",
        "version": "< 1.14"
      },
      {
        "status": "affected",
        "version": "< 1.15"
      }
    ]
  },
  {
    "product": "SAP Enterprise Financial Services (S4CORE)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.01"
      },
      {
        "status": "affected",
        "version": "< 1.02"
      },
      {
        "status": "affected",
        "version": "< 1.03"
      }
    ]
  },
  {
    "product": "SAP Enterprise Financial Services (EA-FINSERV)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.10"
      },
      {
        "status": "affected",
        "version": "< 2.0"
      },
      {
        "status": "affected",
        "version": "< 5.0"
      },
      {
        "status": "affected",
        "version": "< 6.0"
      },
      {
        "status": "affected",
        "version": "< 6.03"
      },
      {
        "status": "affected",
        "version": "< 6.04"
      },
      {
        "status": "affected",
        "version": "< 6.05"
      },
      {
        "status": "affected",
        "version": "< 6.06"
      },
      {
        "status": "affected",
        "version": "< 6.16"
      },
      {
        "status": "affected",
        "version": "< 6.17"
      },
      {
        "status": "affected",
        "version": "< 6.18"
      },
      {
        "status": "affected",
        "version": "< 8.0"
      }
    ]
  },
  {
    "product": "SAP Enterprise Financial Services (Bank/CFM)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 4.63_20"
      }
    ]
  }
]

References

www.securityfocus.com/bid/106477

launchpad.support.sap.com/#/notes/2662687

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.5%

JSON

Related for CVE-2018-2484

prion1 nvd1 cvelist1