CVE-2018-2427

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports (version for Visual Studio .NET, Version 2010) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
SAP	SAP BusinessObjects Business Intelligence Suite	= 4.10; = 4.20
SAP	SAP Crystal Reports	= version for Visual Studio .NET, Version 2010

References

http://www.securityfocus.com/bid/104715Third Party Advisory, VDB Entry
https://launchpad.support.sap.com/#/notes/2620738Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000Patch, Vendor Advisory
http://www.securityfocus.com/bid/104715Third Party Advisory, VDB Entry
https://launchpad.support.sap.com/#/notes/2620738Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000Patch, Vendor Advisory

Timeline

Published: Jul 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-24285.3Under certain conditions SAP UI5 Handler allows an attacker to access information which would otherwise be restricted. Software components a CVE-2018-24316.1SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, does not sufficiently encode user controlled inputs, resulting in C CVE-2018-24325.4SAP BusinessObjects Business Intelligence (BI Launchpad and Central Management Console) versions 4.10, 4.20 and 4.30 allow an attacker to in CVE-2018-24337.5SAP Gateway (SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL CVE-2018-24344.3A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which migh CVE-2018-24356.1SAP NetWeaver Enterprise Portal from 7.0 to 7.02, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, r CVE-2018-24368.8Executing transaction WRCK in SAP R/3 Enterprise Retail (EHP6) does not perform necessary authorization checks for an authenticated user, re CVE-2018-24379.1The SAP Internet Graphics Service (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to externally trigger IGS command executions wh CVE-2018-24387.5The SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, has several denial-of-service vulnerabilities that allow an attacke CVE-2018-24395.9The SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, has insufficient request validation (for example, where the request CVE-2018-24404.4Under certain circumstances SAP Dynamic Authorization Management (DAM) by NextLabs (Java Policy Controller versions 7.7 and 8.5) exposes sen CVE-2018-24415.5Under certain conditions the SAP Change and Transport System (ABAP), SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL