7.5high
CVE-2018-2392in critical feed1 exploitNuclei template
Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropri…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
41.1%
percentile 99%
Public exploits
1
Metasploit · Nuclei check
Summary
Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server (IGS) to become unavailable.
Exploit prediction (EPSS)
41.05% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.
Exploits and detections
- Nuclei template SAP Internet Graphics Server (IGS) - XML External Entity Injection · nuclei detection template
- Metasploit auxiliary/admin/sap/sap_igs_xmlchart_xxe SAP Internet Graphics Server (IGS) XMLCHART XXE · metasploit auxiliary, normal rank · 2018-03-14
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Affected products
- SAP SE SAP Internet Graphics Server
Classification
- Weakness
- CWE-611 Improper Restriction of XML External Entity Reference
References
- launchpad.support.sap.com /#/notes/2525222 · x_refsource_CONFIRM, x_transferred
- blogs.sap.com /2018/02/13/sap-security-patch-day-february-2018/ · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2018-2392
- NVD: CVE-2018-2392
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.