5.4med
CVE-2018-2403
Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access information which would otherwise be restricted.
Published 8 y ago · modified 4 mo ago · JSON
CVSS
5.4
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
1.1%
percentile 67%
Public exploits
0
none known
Summary
Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access information which would otherwise be restricted. It is possible for an authorized user to get SAP Disclosure Management to point a specific chapter type to a chapter the user has not been given access to.
Exploit prediction (EPSS)
1.13% probability of exploitation in the next 30 days, higher than 67% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 5.4 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| CNA | 3.0 | 5.4 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| NVD | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Affected products
- SAP SE SAP Disclosure Management
References
- launchpad.support.sap.com /#/notes/2595800 · x_refsource_MISC, x_transferred
- blogs.sap.com /2018/04/10/sap-security-patch-day-april-2018/ · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/103727 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2018-2403
- NVD: CVE-2018-2403
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.