CVE-2018-2413

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
SAP SE	SAP Disclosure Management	10.1

References

http://www.securityfocus.com/bid/103727Third Party Advisory, VDB Entry
https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2614501Permissions Required, Vendor Advisory
http://www.securityfocus.com/bid/103727Third Party Advisory, VDB Entry
https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2614501Permissions Required, Vendor Advisory

Timeline

Published: Apr 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-24154.7SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Ser CVE-2018-24165.4SAP Identity Management 7.2 and 8.0 do not sufficiently validate an XML document accepted from an untrusted source.CVE-2018-24175.3Under certain conditions, the SAP Identity Management 8.0 (pass of type ToASCII) allows an attacker to access information which would otherw CVE-2018-24189.8SAP MaxDB ODBC driver (all versions before 7.9.09.07) allows an attacker to inject code that can be executed by the application. An attacker CVE-2018-24194.6SAP Enterprise Financial Services (SAPSCORE 1.11, 1.12; S4CORE 1.01, 1.02; EA-FINSERV 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perf CVE-2018-24209.8SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to upload any file (including script files) without CVE-2018-24217.5SAP Internet Graphics Server (IGS) Portwatcher, 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to prevent legitimate users from accessi CVE-2018-24227.5SAP Internet Graphics Server (IGS) Portwatcher, 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to prevent legitimate users from accessi CVE-2018-24237.5SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, HTTP and RFC listener allows an attacker to prevent legitimate users fr CVE-2018-24247.5SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being ad CVE-2018-24255.5Under certain conditions, SAP Business One, 9.2, 9.3, for SAP HANA backup service allows an attacker to access information which would other CVE-2018-24278.8SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports (version for Visual Studio .NET, Version 20