CVE-2018-2427 — Code Injection in SAP Businessobjects Business Intelligence Suite

CWE-94 — Code Injection4 documents4 sources
Severity
8.8HIGHNVD
EPSS
0.6%
top 29.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
SAP Businessobjects Business Intelligence SuiteSAP Crystal ReportsSAP Businessobjects Business Intelligence
Timeline
PublishedJul 10
Latest updateMay 14

Description

SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports (version for Visual Studio .NET, Version 2010) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5sap/sap_crystal_reports= version for Visual Studio .NET, Version 2010

Patches

Patch: wiki.scn.sap.com ↗Patch: wiki.scn.sap.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-vphf-hf77-v4w4: SAP BusinessObjects Business Intelligence Suite, versions 4↗2022-05-14
▶
CVEList
CVE-2018-2427: SAP BusinessObjects Business Intelligence Suite, versions 4↗2018-07-10
▶

💬Community

1
Bugzilla
CVE-2018-6794 suricata: HTTP detection bypass in detect.c and stream-tcp.c↗2018-02-08
▶
CVE-2018-2427 — Code Injection in SAP | cvebase