CVE-2018-2404

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
SAP SE	SAP Disclosure Management	10.1

References

http://www.securityfocus.com/bid/103727Third Party Advisory, VDB Entry
https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2607052Permissions Required, Vendor Advisory
http://www.securityfocus.com/bid/103727Third Party Advisory, VDB Entry
https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2607052Permissions Required, Vendor Advisory

Timeline

Published: Apr 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-24055.4SAP Solution Manager, 7.10, 7.20, Incident Management Work Center allows an attacker to upload a malicious script as an attachment and this CVE-2018-24065.3Unquoted windows search path (directory/path traversal) vulnerability in Crystal Reports Server, OEM Edition (CRSE), 4.0, 4.10, 4.20, 4.30, CVE-2018-24087.3Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of pa CVE-2018-24098.8Improper session management when using SAP Cloud Platform 2.0 (Connectivity Service and Cloud Connector). Under certain conditions, data of CVE-2018-24105.4SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross-Site Scripting (XSS CVE-2018-24128.8SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privile CVE-2018-24138.8SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privile CVE-2018-24154.7SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Ser CVE-2018-24165.4SAP Identity Management 7.2 and 8.0 do not sufficiently validate an XML document accepted from an untrusted source.CVE-2018-24175.3Under certain conditions, the SAP Identity Management 8.0 (pass of type ToASCII) allows an attacker to access information which would otherw CVE-2018-24189.8SAP MaxDB ODBC driver (all versions before 7.9.09.07) allows an attacker to inject code that can be executed by the application. An attacker CVE-2018-24194.6SAP Enterprise Financial Services (SAPSCORE 1.11, 1.12; S4CORE 1.01, 1.02; EA-FINSERV 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perf