CVE-2018-2419

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

SAP Enterprise Financial Services (SAPSCORE 1.11, 1.12; S4CORE 1.01, 1.02; EA-FINSERV 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Metrics

CVSS 3.0 4.6/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
SAP SE	SAP Enterprise Financial Services (SAPSCORE)	1.11; 1.12
SAP SE	SAP Enterprise Financial Services (S4CORE)	1.01; 1.02
SAP SE	SAP Enterprise Financial Services (EA-FINSERV)	6.04; 6.05; 6.06; 6.16; 6.17; 6.18; 8.0

References

http://www.securityfocus.com/bid/104116Third Party Advisory, VDB Entry
https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2596627Permissions Required
http://www.securityfocus.com/bid/104116Third Party Advisory, VDB Entry
https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2596627Permissions Required

Timeline

Published: May 9, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-24209.8SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to upload any file (including script files) without CVE-2018-24217.5SAP Internet Graphics Server (IGS) Portwatcher, 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to prevent legitimate users from accessi CVE-2018-24227.5SAP Internet Graphics Server (IGS) Portwatcher, 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to prevent legitimate users from accessi CVE-2018-24237.5SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, HTTP and RFC listener allows an attacker to prevent legitimate users fr CVE-2018-24247.5SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being ad CVE-2018-24255.5Under certain conditions, SAP Business One, 9.2, 9.3, for SAP HANA backup service allows an attacker to access information which would other CVE-2018-24278.8SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports (version for Visual Studio .NET, Version 20 CVE-2018-24285.3Under certain conditions SAP UI5 Handler allows an attacker to access information which would otherwise be restricted. Software components a CVE-2018-24316.1SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, does not sufficiently encode user controlled inputs, resulting in C CVE-2018-24325.4SAP BusinessObjects Business Intelligence (BI Launchpad and Central Management Console) versions 4.10, 4.20 and 4.30 allow an attacker to in CVE-2018-24337.5SAP Gateway (SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL CVE-2018-24344.3A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which migh