PT-2018-15535 · Sap · Sap Disclosure Management

Published 2018-04-10 · Updated 2019-10-09 · CVE-2018-2404

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Disclosure Management version 10.1

Description The issue allows an attacker to upload any file without proper file format validation.

Recommendations For SAP Disclosure Management version 10.1, consider implementing proper file format validation to prevent unauthorized file uploads until a patch is available. As a temporary workaround, restrict access to the file upload functionality to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-2404

Affected Products

Sap Disclosure Management

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-2404 · Security Note
• https://osv.dev/vulnerability/CVE-2018-2404 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2607052 · Vendor Advisory
• https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018 · Vendor Advisory
• http://securityfocus.com/bid/103727 · Note