Medium severity · published Aug 14, 2018
CVE-2018-2441
Under certain conditions the SAP Change and Transport System (ABAP), SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and…
5.5
CVSS
1%
EPSS
No
On KEV
Description
Under certain conditions the SAP Change and Transport System (ABAP), SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22, 7.45, 7.49, 7.53 and 7.73, allows an attacker to transport information which would otherwise be restricted.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
SAP Change and Transport System (ABAP) · SAP
SAP KERNEL 32 NUC 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 32 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 64 NUC 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22, 7.45, 7.49, 7.53 and 7.73 · source: vendor
SK
Sap Kernel · Sap
7.21; 7.21ext; 7.22; 7.22ext; 7.45; 7.49; +2 more · source: NVD
Affected product
SC
SAP Change and Transport System (ABAP)
SAP
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-2441
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-2441
Third Party Advisory
http://www.securityfocus.com/bid/105090
Permissions Required
https://launchpad.support.sap.com/#/notes/2671160
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499352742