PT-2018-15547 · Sap · Sap Internet Graphics Server

Published 2018-05-09 · Updated 2019-10-09 · CVE-2018-2420

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Internet Graphics Server (IGS) versions 7.20, 7.20EXT, 7.45, 7.49, 7.53

Description The issue allows an attacker to upload any file, including script files, without proper file format validation.

Recommendations For versions 7.20, 7.20EXT, 7.45, 7.49, 7.53, update to a version that includes proper file format validation to prevent unauthorized file uploads.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-2420

Affected Products

Sap Internet Graphics Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-2420 · Security Note
• https://osv.dev/vulnerability/CVE-2018-2420 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2615635 · Vendor Advisory
• https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018 · Vendor Advisory
• http://securityfocus.com/bid/104108 · Note