PT-2018-15525 · Sap · Sap Internet Graphics Server

Published 2018-02-14 · Updated 2018-03-01 · CVE-2018-2393

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SAP Internet Graphics Server (IGS) versions 7.20, 7.20EXT, 7.45, 7.49, 7.53

Description The issue arises from the failure to properly validate XML External Entity, which can cause the SAP Internet Graphics Server (IGS) to become unavailable under certain conditions.

Recommendations For SAP Internet Graphics Server (IGS) version 7.20, update to a version that properly validates XML External Entity. For SAP Internet Graphics Server (IGS) version 7.20EXT, update to a version that properly validates XML External Entity. For SAP Internet Graphics Server (IGS) version 7.45, update to a version that properly validates XML External Entity. For SAP Internet Graphics Server (IGS) version 7.49, update to a version that properly validates XML External Entity. For SAP Internet Graphics Server (IGS) version 7.53, update to a version that properly validates XML External Entity.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-2393

Affected Products

Sap Internet Graphics Server

References · 5

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/sap/sap_igs_xmlchart_xxe.rb · Exploit
• https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2525222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2393 · Security Note
• https://osv.dev/vulnerability/CVE-2018-2393 · Vendor Advisory