« Volver al listado

CVE-2018-2398

Estado: AnalizadaAlta (7.5)—

Under certain conditions SAP Business Client 6.5 allows an attacker to access information which would otherwise be restricted.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Business Client

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-2398",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 1.5
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP Business Client",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-03-14T19:29:00.313",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/103370",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2580967",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/103370",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2580967",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Under certain conditions SAP Business Client 6.5 allows an attacker to access information which would otherwise be restricted."
    },
    {
      "lang": "es",
      "value": "En ciertas condiciones, SAP Business Client 6.5 permite que un atacante acceda a información que normalmente estaría restringida."
    }
  ],
  "lastModified": "2026-06-17T01:55:38.177",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:business_client:6.5:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3017250-3230-49D8-A99F-E51B1FAA765B"
            },
            {
              "criteria": "cpe:2.3:a:sap:business_client:6.5:patch_level1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8458AB93-04B9-412F-8005-E83D2E0AB371"
            },
            {
              "criteria": "cpe:2.3:a:sap:business_client:6.5:patch_level2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2816D81F-3EC1-4601-BB63-87DA36513D39"
            },
            {
              "criteria": "cpe:2.3:a:sap:business_client:6.5:patch_level3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95283C24-58A1-4413-B961-15D3302AE7B6"
            },
            {
              "criteria": "cpe:2.3:a:sap:business_client:6.5:patch_level4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DCF8C247-57B8-4F98-B35D-BC6BB967F89E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}