7.4high
CVE-2018-2503
By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected.
Published 7 y ago · modified 4 mo ago · JSON
CVSS
7.4
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 48%
Public exploits
0
none known
Summary
By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected. This has been fixed in SAP NetWeaver AS Java (ServerCore versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50).
Exploit prediction (EPSS)
0.57% probability of exploitation in the next 30 days, higher than 48% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 7.4 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| NVD | 2.0 | 3.3 | AV:A/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- SAP SAP NetWeaver AS Java (ServerCore)
Classification
- Weakness
- CWE-862 Missing Authorization
References
- wiki.scn.sap.com /wiki/pages/viewpage.action?pageId=508559699 · x_refsource_MISC, x_transferred
- securityfocus.com /bid/106156 · vdb-entry, x_refsource_BID, x_transferred
- launchpad.support.sap.com /#/notes/2658279 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-2503
- NVD: CVE-2018-2503
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.