SAP Security Patch Day — February 2018
Tuesday, 13 February 2018
- Vulnerabilities
- 28
- Critical
- 0
- High
- 0
- Zero-days
- 0
- Public exploit
- 2
Exploited 0
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
None of this release's vulnerabilities is known to be exploited so far.
Public exploit code 2
Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.
-
Unscored
CVE-2018-2392 Public exploit Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SA…EPSS 41%
-
Unscored
CVE-2018-2393 Public exploit Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SA…EPSS 15%
All vulnerabilities 28
Unscored28 ShowHide
-
Unscored
CVE-2018-2392 Public exploit Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SA…EPSS 41%
-
Unscored
CVE-2018-2393 Public exploit Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SA…EPSS 15%
- Unscored
-
Unscored
CVE-2018-2369 Under certain conditions SAP HANA, 1.00, 2.00, allows an unauthenticated attacker to access information which would otherwise be restricted. An attacker can mi…EPSS 1.5%
-
Unscored
CVE-2018-2370 Server Side Request Forgery (SSRF) vulnerability in SAP Central Management Console, BI Launchpad and Fiori BI Launchpad, 4.10, from 4.20, from 4.30, could allo…EPSS 1.2%
- Unscored
- Unscored
-
Unscored
CVE-2018-2373 Under certain circumstances, a specific endpoint of the Controller's API could be misused by unauthenticated users to execute SQL statements that deliver infor…EPSS 1.2%
-
Unscored
CVE-2018-2374 In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve sensitive application d…EPSS 1.2%
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2018-2381 SAP ERP Financials Information System (SAP_APPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAP_FIN 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE 1.00, 1.01, 1.02) does no…EPSS 1.2%
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2018-2394 Under certain conditions an unauthenticated malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7…EPSS 1%
-
Unscored
CVE-2018-2395 Under certain conditions a malicious user may retrieve information on SAP Internet Graphic Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, overwrite existing im…EPSS 1.5%
- Unscored