Lucene search

[email protected]CVE-2018-2503

HistoryDec 11, 2018 - 11:00 p.m.

CVE-2018-2503

2018-12-1123:00:00

CWE-862

[email protected]

web.nvd.nist.gov

sap

netweaver

as java

keystore service

access restriction

vulnerability

nvd

cve-2018-2503

3.3 Low

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:A/AC:L/Au:N/C:P/I:N/A:N

7.4 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.9%

JSON

By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected. This has been fixed in SAP NetWeaver AS Java (ServerCore versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50).

Affected configurations

NVD

Node

sapnetweaver_application_server_javaMatch7.11

sapnetweaver_application_server_javaMatch7.20

sapnetweaver_application_server_javaMatch7.30

sapnetweaver_application_server_javaMatch7.31

sapnetweaver_application_server_javaMatch7.40

sapnetweaver_application_server_javaMatch7.50

CPENameOperatorVersion
sap:netweaver_application_server_javasap netweaver application server javaeq7.11
sap:netweaver_application_server_javasap netweaver application server javaeq7.20
sap:netweaver_application_server_javasap netweaver application server javaeq7.30
sap:netweaver_application_server_javasap netweaver application server javaeq7.31
sap:netweaver_application_server_javasap netweaver application server javaeq7.40
sap:netweaver_application_server_javasap netweaver application server javaeq7.50

CPE	Name	Operator	Version
sap:netweaver_application_server_java	sap netweaver application server java	eq	7.11
sap:netweaver_application_server_java	sap netweaver application server java	eq	7.20
sap:netweaver_application_server_java	sap netweaver application server java	eq	7.30
sap:netweaver_application_server_java	sap netweaver application server java	eq	7.31
sap:netweaver_application_server_java	sap netweaver application server java	eq	7.40
sap:netweaver_application_server_java	sap netweaver application server java	eq	7.50

CNA Affected

[
  {
    "product": "SAP NetWeaver AS Java (ServerCore)",
    "vendor": "SAP",
    "versions": [
      {
        "status": "affected",
        "version": "= 7.11"
      },
      {
        "status": "affected",
        "version": "= 7.20"
      },
      {
        "status": "affected",
        "version": "= 7.30"
      },
      {
        "status": "affected",
        "version": "= 7.31"
      },
      {
        "status": "affected",
        "version": "= 7.40"
      },
      {
        "status": "affected",
        "version": "= 7.50"
      }
    ]
  }
]

References

www.securityfocus.com/bid/106156

launchpad.support.sap.com/#/notes/2658279

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699

3.3 Low

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:A/AC:L/Au:N/C:P/I:N/A:N

7.4 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.9%

JSON

Related for CVE-2018-2503

prion1 cvelist1 nvd1