CVE-2018-2484
SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04,
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.13, 1.14, 1.15, 1.01, 1.02, and 14 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0; Bank/CFM 4.63_20) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Timeline
- CVE published
- Record last updated
Affected versions
- SAP SE SAP Enterprise Financial Services (SAPSCORE)
fixed in 1.13; fixed in 1.14; fixed in 1.15
- SAP SE SAP Enterprise Financial Services (S4CORE)
fixed in 1.01; fixed in 1.02; fixed in 1.03
- SAP SE SAP Enterprise Financial Services (EA-FINSERV)
fixed in 1.10; fixed in 2.0; fixed in 5.0; fixed in 6.0; fixed in 6.03; fixed in 6.04; fixed in 6.05; fixed in 6.06; fixed in 6.16; fixed in 6.17; fixed in 6.18; fixed in 8.0
- SAP SE SAP Enterprise Financial Services (Bank/CFM)
fixed in 4.63_20