CVE-2018-2392

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server (IGS) to become unavailable.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
SAP SE	SAP Internet Graphics Server	7.20; 7.20EXT; 7.45; 7.49; 7.53

References

https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2525222Permissions Required, Vendor Advisory
https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2525222Permissions Required, Vendor Advisory

Timeline

Published: Feb 14, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-23937.5Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropria CVE-2018-23946.5Under certain conditions an unauthenticated malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS CVE-2018-23958.8Under certain conditions a malicious user may retrieve information on SAP Internet Graphic Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, ov CVE-2018-23966.5Under certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT,CVE-2018-23975.4In SAP Business Objects Business Intelligence Platform, 4.00, 4.10, 4.20, 4.30, the Central Management Console (CMC) does not sufficiently e CVE-2018-23987.5Under certain conditions SAP Business Client 6.5 allows an attacker to access information which would otherwise be restricted.CVE-2018-23996.1Cross-Site Scripting in Process Monitoring Infrastructure, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to inefficient encoding of u CVE-2018-24007.5Under certain conditions SAP Business Process Automation (BPA) By Redwood, 9.00, 9.10, allows an attacker to access information which would CVE-2018-24018.8SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting CVE-2018-24028.4In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about ca CVE-2018-24036.5Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access information which would otherwise be restricted. It is CVE-2018-24049.8SAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation.