PT-2018-15543 · Sap · Sap Identity Management

Published 2018-05-09 · Updated 2019-03-14 · CVE-2018-2416

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions SAP Identity Management versions 7.2 through 8.0

Description The issue arises from insufficient validation of an XML document accepted from an untrusted source.

Recommendations For SAP Identity Management versions 7.2 through 8.0, update to a version that includes the fix for this issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-2416

Affected Products

Sap Identity Management

References · 8

• https://launchpad.support.sap.com/#/notes/2653519 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2597875 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2416 · Security Note
• https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-2416 · Vendor Advisory
• http://securityfocus.com/bid/104106 · Note
• http://securityfocus.com/bid/105076 · Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499352742 · Note