Lucene search

SapCVE-2018-2392

HistoryFeb 14, 2018 - 12:29 p.m.

CVE-2018-2392

2018-02-1412:29:01

CWE-611

sap

web.nvd.nist.gov

sap

igs

7.20

7.45

7.49

7.53

xml

external entity

vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.003

Percentile

68.4%

JSON

Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server (IGS) to become unavailable.

Affected configurations

Nvd

Node

sapinternet_graphics_serverMatch7.20

sapinternet_graphics_serverMatch7.20ext

sapinternet_graphics_serverMatch7.45

sapinternet_graphics_serverMatch7.49

sapinternet_graphics_serverMatch7.53

VendorProductVersionCPE
sapinternet_graphics_server7.20cpe:2.3:a:sap:internet_graphics_server:7.20:*:*:*:*:*:*:*
sapinternet_graphics_server7.20extcpe:2.3:a:sap:internet_graphics_server:7.20ext:*:*:*:*:*:*:*
sapinternet_graphics_server7.45cpe:2.3:a:sap:internet_graphics_server:7.45:*:*:*:*:*:*:*
sapinternet_graphics_server7.49cpe:2.3:a:sap:internet_graphics_server:7.49:*:*:*:*:*:*:*
sapinternet_graphics_server7.53cpe:2.3:a:sap:internet_graphics_server:7.53:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	internet_graphics_server	7.20	cpe:2.3:a:sap:internet_graphics_server:7.20:::::::*
sap	internet_graphics_server	7.20ext	cpe:2.3:a:sap:internet_graphics_server:7.20ext:::::::*
sap	internet_graphics_server	7.45	cpe:2.3:a:sap:internet_graphics_server:7.45:::::::*
sap	internet_graphics_server	7.49	cpe:2.3:a:sap:internet_graphics_server:7.49:::::::*
sap	internet_graphics_server	7.53	cpe:2.3:a:sap:internet_graphics_server:7.53:::::::*

CNA Affected

[
  {
    "product": "SAP Internet Graphics Server",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "7.20"
      },
      {
        "status": "affected",
        "version": "7.20EXT"
      },
      {
        "status": "affected",
        "version": "7.45"
      },
      {
        "status": "affected",
        "version": "7.49"
      },
      {
        "status": "affected",
        "version": "7.53"
      }
    ]
  }
]

References

blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/

launchpad.support.sap.com/#/notes/2525222

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.003

Percentile

68.4%

JSON

Related for CVE-2018-2392