CVE-2018-2454

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 (in business function EAFS_BCA_BUSOPR_2) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
SAP	SAP Enterprise Financial Services	= 6.05; = 6.06; = 6.16; = 6.17; = 6.18; = 8.0

References

http://www.securityfocus.com/bid/105316Third Party Advisory, VDB Entry
https://launchpad.support.sap.com/#/notes/2645133Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993Vendor Advisory
http://www.securityfocus.com/bid/105316Third Party Advisory, VDB Entry
https://launchpad.support.sap.com/#/notes/2645133Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993Vendor Advisory

Timeline

Published: Sep 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-24558.8SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 (in business function EAFS_BCA_BUSOPR_SEPA) does not perform n CVE-2018-24576.5Under certain conditions SAP Adaptive Server Enterprise, version 16.0, allows some privileged users to access information which would otherw CVE-2018-24587.5Under certain conditions, Crystal Report using SAP Business One, versions 9.2 and 9.3, connection type allows an attacker to access informat CVE-2018-24597.5Users of an SAP Mobile Platform (version 3.0) Offline OData application, which uses Offline OData-supplied delta tokens (which is on by defa CVE-2018-24605.9SAP Business One Android application, version 1.2, does not verify the certificate properly for HTTPS connection. This allows attacker to do CVE-2018-24618.8Missing authorization check in SAP HCM Fiori "People Profile" (GBX01 HR version 6.0) for an authenticated user which may result in an escala CVE-2018-24628.8In certain cases, BEx Web Java Runtime Export Web Service in SAP NetWeaver BI 7.30, 7.31. 7.40, 7.41, 7.50, does not sufficiently validate a CVE-2018-24638.6The Omni Commerce Connect API (OCC) of SAP Hybris Commerce, versions 6.*, is vulnerable to server-side request forgery (SSRF) attacks. This CVE-2018-24646.1SAP WebDynpro Java, versions 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-CVE-2018-24657.5SAP HANA (versions 1.0 and 2.0) Extended Application Services classic model OData parser does not sufficiently validate XML. By exploiting, CVE-2018-24665.4In Impact and Lineage Analysis in SAP Data Services, version 4.2, the management console does not sufficiently validate user-controlled inpu CVE-2018-24675.3In the Software Development Kit in SAP BusinessObjects BI Platform Servers, versions 4.1 and 4.2, using the specially crafted URL in a Web B