CVE-2018-2441

Under certain conditions the SAP Change and Transport System (ABAP), SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22, 7.45, 7.49, 7.53 and 7.73, allows an attacker to transport information which would otherwise be restricted.

CVSS v3 5.5 MEDIUM
CVSS v2.0 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Exploitability : 1.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:N

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/105090	Third Party Advisory VDB Entry
https://launchpad.support.sap.com/#/notes/2671160	Permissions Required Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499352742	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sap:sap_kernel:7.21:::::::*
	cpe:2.3:a:sap:sap_kernel:7.21ext:::::::*
	cpe:2.3:a:sap:sap_kernel:7.22:::::::*
	cpe:2.3:a:sap:sap_kernel:7.22ext:::::::*
	cpe:2.3:a:sap:sap_kernel:7.45:::::::*
	cpe:2.3:a:sap:sap_kernel:7.49:::::::*
	cpe:2.3:a:sap:sap_kernel:7.53:::::::*
	cpe:2.3:a:sap:sap_kernel:7.73:::::::*

History

No history.

Information

Published : 2018-08-14 16:29

Updated : 2023-12-10 12:44

NVD link : CVE-2018-2441

Mitre link : CVE-2018-2441

CVE.ORG link : CVE-2018-2441

JSON object : View

Products Affected

sap

sap_kernel

CWE

NVD-CWE-noinfo

{"id": "CVE-2018-2441", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 1.2}]}, "published": "2018-08-14T16:29:00.553", "references": [{"url": "http://www.securityfocus.com/bid/105090", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cna@sap.com"}, {"url": "https://launchpad.support.sap.com/#/notes/2671160", "tags": ["Permissions Required", "Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499352742", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Under certain conditions the SAP Change and Transport System (ABAP), SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22, 7.45, 7.49, 7.53 and 7.73, allows an attacker to transport information which would otherwise be restricted."}, {"lang": "es", "value": "En ciertas condiciones, SAP Change and Transport System (ABAP), SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 y 7.22EXT y SAP KERNEL 7.21, 7.22, 7.45, 7.49, 7.53 y 7.73, permiten que un atacante transporte informaci\u00f3n que, de otra forma, estar\u00eda restringida."}], "lastModified": "2020-08-24T17:37:01.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:sap_kernel:7.21:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1DB2B37-EC52-4FE6-9861-A98A9E365B61"}, {"criteria": "cpe:2.3:a:sap:sap_kernel:7.21ext:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "168D38D8-CE37-4FF4-B089-DCBB0D5A3387"}, {"criteria": "cpe:2.3:a:sap:sap_kernel:7.22:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80D1ECE8-0465-4B82-A0B7-BC55438FFC43"}, {"criteria": "cpe:2.3:a:sap:sap_kernel:7.22ext:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56247321-E033-4097-A176-BE71DEBD5920"}, {"criteria": "cpe:2.3:a:sap:sap_kernel:7.45:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "517E04CB-B712-477E-8F64-B35F9D0D932B"}, {"criteria": "cpe:2.3:a:sap:sap_kernel:7.49:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "018F8061-43B6-4F29-B914-C779569C58CD"}, {"criteria": "cpe:2.3:a:sap:sap_kernel:7.53:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F7EA62C-67A6-4971-AC33-D5A3D390CE52"}, {"criteria": "cpe:2.3:a:sap:sap_kernel:7.73:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2DC3DD5-36D6-462E-BD41-E1EDB5843A8A"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}