« Volver al listado

CVE-2018-2388

Estado: ModificadaMedia (6.1)—

Stored cross-site scripting vulnerability in SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Internet Graphics Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-2388",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP Internet Graphics Server",
          "versions": [
            {
              "status": "affected",
              "version": "7.20"
            },
            {
              "status": "affected",
              "version": "7.20EXT"
            },
            {
              "status": "affected",
              "version": "7.45"
            },
            {
              "status": "affected",
              "version": "7.49"
            },
            {
              "status": "affected",
              "version": "7.53"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-02-14T12:29:01.250",
  "references": [
    {
      "url": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2525222",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2525222",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Stored cross-site scripting vulnerability in SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Cross-Site Scripting (XSS) persistente en SAP internet Graphics Server 7.20, 7.20EXT, 7.45, 7.49 y 7.53."
    }
  ],
  "lastModified": "2026-06-17T01:55:37.153",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:internet_graphics_server:7.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB63DB38-282E-44F5-B998-E0A419CBDDDF"
            },
            {
              "criteria": "cpe:2.3:a:sap:internet_graphics_server:7.20ext:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52899667-D267-4399-B1DD-428DCFAFECAA"
            },
            {
              "criteria": "cpe:2.3:a:sap:internet_graphics_server:7.45:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F87D81E-242D-4679-8DB3-479DB2A98F46"
            },
            {
              "criteria": "cpe:2.3:a:sap:internet_graphics_server:7.49:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E19FB816-EFD3-46EA-A144-699055394B86"
            },
            {
              "criteria": "cpe:2.3:a:sap:internet_graphics_server:7.53:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BAE591D5-05DA-41FE-A9C1-0A5521E83024"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}