PT-2018-15594 · Sap · Sap Basis

Publicado 2018-11-13 · Atualizado 2020-08-24 · CVE-2018-2478

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Basis versions 7.0 through 7.02 SAP Basis versions 7.10 through 7.11 SAP Basis version 7.30 SAP Basis version 7.31 SAP Basis version 7.40 SAP Basis versions 7.50 through 7.53

Description An issue allows an attacker to execute commands on the host of a TREX / BWA installation using specially crafted inputs. The commands that can be executed are limited to those that can be run by the sidadm user, and the specific commands depend on the privileges of the sidadm user.

Recommendations For SAP Basis versions 7.0 through 7.02, update to a version outside of this range to resolve the issue. For SAP Basis versions 7.10 through 7.11, update to a version outside of this range to resolve the issue. For SAP Basis version 7.30, update to a version outside of this range to resolve the issue. For SAP Basis version 7.31, update to a version outside of this range to resolve the issue. For SAP Basis version 7.40, update to a version outside of this range to resolve the issue. For SAP Basis versions 7.50 through 7.53, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting the privileges of the sidadm user to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2018-2478

Produtos afetados

Sap Basis

Referências · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-2478 · Aviso do Fabricante
• http://securityfocus.com/bid/105904 · Nota
• https://launchpad.support.sap.com/#/notes/2675696 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-2478 · Nota de Segurança