PT-2018-1590 · Sap · Sap Enterprise Financial Services

Published 2018-09-11 · Updated 2019-10-03 · CVE-2018-2454

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Enterprise Financial Services versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0

Description The issue is related to the EAFS BCA BUSOPR 2 business function, where the software does not perform necessary authorization checks for an authenticated user. This results in an escalation of privileges. The vulnerability is associated with errors in the authorization procedure, which can be exploited by a remote attacker to elevate their privileges.

Recommendations For SAP Enterprise Financial Services versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0, ensure that proper authorization checks are implemented for the EAFS BCA BUSOPR 2 business function to prevent privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Missing Authorization

Weakness Enumeration

CWE-285

CWE-862

Related Identifiers

BDU:2018-01147

CVE-2018-2454

Affected Products

Sap Enterprise Financial Services

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-2454 · Security Note
• https://osv.dev/vulnerability/CVE-2018-2454 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2645133 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01147 · Security Note
• http://securityfocus.com/bid/105316 · Note