CVE-2018-2503
published 2018-12-11CVE-2018-2503: By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected. This has been fixed in…
PriorityP336high7.4CVSS 3.1
AVAACLPRNUINSCCHINAN
EPSS
0.55%
42.4th percentile
By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected. This has been fixed in SAP NetWeaver AS Java (ServerCore versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50).
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap | netweaver_application_server_java | — | — |
| sap | netweaver_application_server_java | — | — |
| sap | netweaver_application_server_java | — | — |
| sap | netweaver_application_server_java | — | — |
| sap | netweaver_application_server_java | — | — |
| sap | netweaver_application_server_java | — | — |
| sap | sap_netweaver_as_java | — | — |
| sap | sap_netweaver_as_java | — | — |
| sap | sap_netweaver_as_java | — | — |
| sap | sap_netweaver_as_java | — | — |
| sap | sap_netweaver_as_java | — | — |
| sap | sap_netweaver_as_java | — | — |
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
nvdv2.03.3LOWAV:A/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/106156https://launchpad.support.sap.com/#/notes/2658279https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699http://www.securityfocus.com/bid/106156https://launchpad.support.sap.com/#/notes/2658279https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699
2018-12-11
Published