5.5

CVE-2018-2419

SAP Enterprise Financial Services (SAPSCORE 1.11, 1.12; S4CORE 1.01, 1.02; EA-FINSERV 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Data is provided by the National Vulnerability Database (NVD)
SAP ≫ Sapscore Version1.11
SAP ≫ Sapscore Version1.12
SAP ≫ S4core Version1.01
SAP ≫ S4core Version1.02
SAP ≫ Ea-finserv Version6.04
SAP ≫ Ea-finserv Version6.05
SAP ≫ Ea-finserv Version6.06
SAP ≫ Ea-finserv Version6.16
SAP ≫ Ea-finserv Version6.17
SAP ≫ Ea-finserv Version6.18
SAP ≫ Ea-finserv Version8.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.18% 0.37
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.6 2.1 2.5
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
nvd@nist.gov 5.5 8 4.9
AV:N/AC:L/Au:S/C:P/I:P/A:N
cna@sap.com 3.7 1.2 2.5
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

http://www.securityfocus.com/bid/104116
Third Party Advisory
VDB Entry