PT-2018-3536 · Sap · Sap Netweaver As Java

Published 2018-12-11 · Updated 2021-04-20 · CVE-2018-2492

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS Java versions prior to 7.2 SAP NetWeaver AS Java versions prior to 7.30 SAP NetWeaver AS Java versions prior to 7.31 SAP NetWeaver AS Java versions prior to 7.40 SAP NetWeaver AS Java versions prior to 7.50

Description: The issue exists due to insufficient validation of input data in the SAP NetWeaver platform. This can be exploited by a remote attacker to cause a denial of service. Specifically, the SAML 2.0 functionality does not sufficiently validate XML documents received from an untrusted source.

Recommendations: For versions prior to 7.2, update to version 7.2 or later. For versions prior to 7.30, update to version 7.30 or later. For versions prior to 7.31, update to version 7.31 or later. For versions prior to 7.40, update to version 7.40 or later. For versions prior to 7.50, update to version 7.50 or later.

Fix

XXE

RCE

Weakness Enumeration

CWE-611

CWE-20

Related Identifiers

BDU:2020-03310

CVE-2018-2492

Affected Products

Sap Netweaver As Java

References · 7

• https://bdu.fstec.ru/vul/2020-03310 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-2492 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2492 · Security Note
• https://securityfocus.com/bid/106153/info · Note
• https://launchpad.support.sap.com/#/notes/2642680 · Note
• http://securityfocus.com/bid/106153 · Note