8.8high
CVE-2018-2367
ABAP File Interface in, SAP BASIS, from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker to exploit…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.9%
percentile 79%
Public exploits
0
none known
Summary
ABAP File Interface in, SAP BASIS, from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
Exploit prediction (EPSS)
1.87% probability of exploitation in the next 30 days, higher than 79% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- SAP SE SAP BASIS (ABAP File Interface)
Classification
- Weakness
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
- blogs.sap.com /2018/02/13/sap-security-patch-day-february-2018/ · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/103006 · vdb-entry, x_refsource_BID, x_transferred
- launchpad.support.sap.com /#/notes/2562089 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2018-2367
- NVD: CVE-2018-2367
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.