CVE-2018-2448

Under certain conditions SAP SRM-MDM (CATALOG versions 3.0, 7.01, 7.02) utilities functionality allows an attacker to access information of user existence which would otherwise be restricted.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/105077	Third Party Advisory VDB Entry
https://launchpad.support.sap.com/#/notes/2653846	Permissions Required Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499352742	Vendor Advisory
http://www.securityfocus.com/bid/105077	Third Party Advisory VDB Entry
https://launchpad.support.sap.com/#/notes/2653846	Permissions Required Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499352742	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sap:supplier_relationship_management_mdm_catalog:3.0:::::::*
	cpe:2.3:a:sap:supplier_relationship_management_mdm_catalog:7.01:::::::*
	cpe:2.3:a:sap:supplier_relationship_management_mdm_catalog:7.02:::::::*

History

No history.

Information

Published : 2018-08-14 16:29

Updated : 2024-11-21 04:03

NVD link : CVE-2018-2448

Mitre link : CVE-2018-2448

CVE.ORG link : CVE-2018-2448

JSON object : View

Products Affected

sap

supplier_relationship_management_mdm_catalog

CWE

NVD-CWE-noinfo

{"id": "CVE-2018-2448", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2018-08-14T16:29:01.303", "references": [{"url": "http://www.securityfocus.com/bid/105077", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cna@sap.com"}, {"url": "https://launchpad.support.sap.com/#/notes/2653846", "tags": ["Permissions Required", "Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499352742", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}, {"url": "http://www.securityfocus.com/bid/105077", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://launchpad.support.sap.com/#/notes/2653846", "tags": ["Permissions Required", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499352742", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Under certain conditions SAP SRM-MDM (CATALOG versions 3.0, 7.01, 7.02) utilities functionality allows an attacker to access information of user existence which would otherwise be restricted."}, {"lang": "es", "value": "En ciertas condiciones, SAP SRM-MDM (CATALOG en versiones 3.0, 7.01 y 7.02) utiliza funcionalidades que permiten que un atacante acceda a informaci\u00f3n de usuarios que normalmente estar\u00eda restringida."}], "lastModified": "2024-11-21T04:03:49.993", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:supplier_relationship_management_mdm_catalog:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7BF83F7-AFD2-41EC-B3A8-0ED02AA06D50"}, {"criteria": "cpe:2.3:a:sap:supplier_relationship_management_mdm_catalog:7.01:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0BDE5045-ABE1-48BA-9B1F-8D9FB244FB08"}, {"criteria": "cpe:2.3:a:sap:supplier_relationship_management_mdm_catalog:7.02:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0DBB2C19-F3D3-41FC-BCBE-B86C3660C2DD"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}