CVE Feed

    Dashboard / CVE / CVE-2018-2478

    CVE-2018-2478

    An attacker can use specially crafted inputs to execute commands on the host of a TREX / BWA installation, SAP Basis, versions: 7.0 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40 and 7.50 to 7.53. Not all commands are possible, only those that can be executed by the <sid>adm user. The commands executed depend upon the privileges of the <sid>adm user.

    Published:Nov 13, 2018
    Last Modified:Nov 21, 2024
    EPS:Nov 13, 2018
    EPSS Score:0.00368
    CVSS Score:7.2

    Affected Products

    Vendor
    Sap
    Product
    Basis

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-34320 (CVSS 9.3) — BASIS BBj versions prior to 25.00 contain a Jetty-served web endpoint that fails to properly validate or canon…
    CVE-2023-29110 (CVSS 3.7) — The SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755…
    CVE-2023-29109 (CVSS 4.4) — The SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASI…
    CVE-2022-41264 (CVSS 8.8) — Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 7…
    CVE-2020-6307 (CVSS 4.3) — Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and…
    CVE-2019-0248 (CVSS 5.9) — Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High