« Volver al listado

CVE-2018-2399

Estado: ModificadaMedia (6.1)—

Cross-Site Scripting in Process Monitoring Infrastructure, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to inefficient encoding of user controlled inputs.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Process Monitoring Infrastructure

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-2399",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP Process Monitoring Infrastructure",
          "versions": [
            {
              "status": "affected",
              "version": "from 7.10 to 7.11"
            },
            {
              "status": "affected",
              "version": "7.20"
            },
            {
              "status": "affected",
              "version": "7.30"
            },
            {
              "status": "affected",
              "version": "7.31"
            },
            {
              "status": "affected",
              "version": "7.40"
            },
            {
              "status": "affected",
              "version": "7.50"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-03-14T19:29:00.360",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/103372",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2592807",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/103372",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2592807",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-Site Scripting in Process Monitoring Infrastructure, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to inefficient encoding of user controlled inputs."
    },
    {
      "lang": "es",
      "value": "Cross-Site Scripting (XSS) en Process Monitoring Infrastructure, desde la versión 7.10 hasta la 7.11, 7.20, 7.30, 7.31, 7.40 y 7.50, debido a la codificación insuficiente de entradas controladas por el usuario."
    }
  ],
  "lastModified": "2026-06-17T01:55:38.297",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:process_monitoring_infrastructure:7.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E16544E-705B-40F5-A7B8-90D00C5205B4"
            },
            {
              "criteria": "cpe:2.3:a:sap:process_monitoring_infrastructure:7.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FCC0985B-E4F0-4262-A14A-CC7374BDE154"
            },
            {
              "criteria": "cpe:2.3:a:sap:process_monitoring_infrastructure:7.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF3CFB92-2E2B-4744-89E9-3AF69C0D5D0F"
            },
            {
              "criteria": "cpe:2.3:a:sap:process_monitoring_infrastructure:7.30:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F544C65F-396A-46E2-909F-671F4A6C6110"
            },
            {
              "criteria": "cpe:2.3:a:sap:process_monitoring_infrastructure:7.31:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A7CAB459-F181-43C3-AB3D-7D4A173FA3AA"
            },
            {
              "criteria": "cpe:2.3:a:sap:process_monitoring_infrastructure:7.40:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7866751F-52EB-4793-8C5A-4A98B11E0186"
            },
            {
              "criteria": "cpe:2.3:a:sap:process_monitoring_infrastructure:7.50:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9433917-FDA4-460B-B5ED-23F876CCE239"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}