Vulnerability Details CVE-2018-2454
SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 (in business function EAFS_BCA_BUSOPR_2) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 65.5%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.5
References
- http://www.securityfocus.com/bid/105316
- https://launchpad.support.sap.com/#/notes/2645133
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993
- http://www.securityfocus.com/bid/105316
- https://launchpad.support.sap.com/#/notes/2645133
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993
Products affected by CVE-2018-2454
-
cpe:2.3:a:sap:enterprise_financial_services:6.05
-
cpe:2.3:a:sap:enterprise_financial_services:6.06
-
cpe:2.3:a:sap:enterprise_financial_services:6.16
-
cpe:2.3:a:sap:enterprise_financial_services:6.17
-
cpe:2.3:a:sap:enterprise_financial_services:6.18
-
cpe:2.3:a:sap:enterprise_financial_services:8.0