Lucene search

[email protected]CVE-2018-2503

HistoryDec 11, 2018 - 10:29 p.m.

CVE-2018-2503

2018-12-1122:29:00

CWE-862

[email protected]

web.nvd.nist.gov

sap

netweaver

as java

keystore service

access restriction

vulnerability

nvd

cve-2018-2503

7.4 High

CVSS3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

7 High

AI Score

Confidence

Low

3.3 Low

CVSS2

Access Vector

ADJACENT_NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:A/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

41.0%

JSON

By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected. This has been fixed in SAP NetWeaver AS Java (ServerCore versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50).

CPENameOperatorVersion
sap:netweaver_application_server_javasap netweaver application server javaeq7.20
sap:netweaver_application_server_javasap netweaver application server javaeq7.30
sap:netweaver_application_server_javasap netweaver application server javaeq7.31
sap:netweaver_application_server_javasap netweaver application server javaeq7.40
sap:netweaver_application_server_javasap netweaver application server javaeq7.50
sap:netweaver_application_server_javasap netweaver application server javaeq7.11

CPE	Name	Operator	Version
sap:netweaver_application_server_java	sap netweaver application server java	eq	7.20
sap:netweaver_application_server_java	sap netweaver application server java	eq	7.30
sap:netweaver_application_server_java	sap netweaver application server java	eq	7.31
sap:netweaver_application_server_java	sap netweaver application server java	eq	7.40
sap:netweaver_application_server_java	sap netweaver application server java	eq	7.50
sap:netweaver_application_server_java	sap netweaver application server java	eq	7.11

References

www.securityfocus.com/bid/106156

launchpad.support.sap.com/#/notes/2658279

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699

7.4 High

CVSS3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

7 High

AI Score

Confidence

Low

3.3 Low

CVSS2

Access Vector

ADJACENT_NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:A/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

41.0%

JSON

Related for CVE-2018-2503

prion1