7.5high
CVE-2018-2393in critical feed1 exploit
Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropri…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
15.5%
percentile 97%
Public exploits
1
Metasploit
Summary
Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server (IGS) to become unavailable.
Exploit prediction (EPSS)
15.46% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.
Exploits and detections
- Metasploit auxiliary/admin/sap/sap_igs_xmlchart_xxe SAP Internet Graphics Server (IGS) XMLCHART XXE · metasploit auxiliary, normal rank · 2018-03-14
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Affected products
- SAP SE SAP Internet Graphics Server
Classification
- Weakness
- CWE-611 Improper Restriction of XML External Entity Reference
References
- launchpad.support.sap.com /#/notes/2525222 · x_refsource_CONFIRM, x_transferred
- blogs.sap.com /2018/02/13/sap-security-patch-day-february-2018/ · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2018-2393
- NVD: CVE-2018-2393
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.