{"containers": {"cna": {"affected": [{"product": "SAP Basis (AS ABAP of SAP NetWeaver)", "vendor": "SAP", "versions": [{"status": "affected", "version": "= 7.00 to 7.02"}, {"status": "affected", "version": "= 7.10 to 7.30"}, {"status": "affected", "version": "= 7.31"}, {"status": "affected", "version": "= 7.40"}]}, {"product": "SAP Basis (ABAP Platform)", "vendor": "SAP", "versions": [{"status": "affected", "version": "= 7.50 to 7.53"}]}], "datePublic": "2018-12-11T00:00:00", "descriptions": [{"lang": "en", "value": "Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP Basis AS ABAP of SAP NetWeaver 700 to 750, from 750 onwards delivered as ABAP Platform."}], "problemTypes": [{"descriptions": [{"description": "Missing Authorization Check", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-12-11T22:57:01", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699"}, {"tags": ["x_refsource_MISC"], "url": "https://launchpad.support.sap.com/#/notes/2698996"}], "source": {"discovery": "UNKNOWN"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cna@sap.com", "ID": "CVE-2018-2494", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SAP Basis (AS ABAP of SAP NetWeaver)", "version": {"version_data": [{"version_name": "=", "version_value": "7.00 to 7.02"}, {"version_name": "=", "version_value": "7.10 to 7.30"}, {"version_name": "=", "version_value": "7.31"}, {"version_name": "=", "version_value": "7.40"}]}}, {"product_name": "SAP Basis (ABAP Platform)", "version": {"version_data": [{"version_name": "=", "version_value": "7.50 to 7.53"}]}}]}, "vendor_name": "SAP"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP Basis AS ABAP of SAP NetWeaver 700 to 750, from 750 onwards delivered as ABAP Platform."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Missing Authorization Check"}]}]}, "references": {"reference_data": [{"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699", "refsource": "MISC", "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699"}, {"name": "https://launchpad.support.sap.com/#/notes/2698996", "refsource": "MISC", "url": "https://launchpad.support.sap.com/#/notes/2698996"}]}, "source": {"discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2018-2494", "datePublished": "2018-12-11T23:00:00", "dateReserved": "2017-12-15T00:00:00", "dateUpdated": "2018-12-11T22:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*", "matchCriteriaId": "CF38D1E1-E07F-4E51-AE76-E27E7CE4F55C", "versionEndIncluding": "7.02", "versionStartIncluding": "7.00", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*", "matchCriteriaId": "03F8C580-971A-46D8-B66D-B1261F17FF22", "versionEndIncluding": "7.30", "versionStartIncluding": "7.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*", "matchCriteriaId": "0DC0CEF3-7409-418E-9C9A-E75D8B290D57", "versionEndIncluding": "7.53", "versionStartIncluding": "7.50", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.31:*:*:*:*:*:*:*", "matchCriteriaId": "341C07C1-2B4A-475D-B200-1021EB6B1F79", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.40:*:*:*:*:*:*:*", "matchCriteriaId": "4D80CC30-EE05-439F-BF2C-1267837137DE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP Basis AS ABAP of SAP NetWeaver 700 to 750, from 750 onwards delivered as ABAP Platform."}, {"lang": "es", "value": "Se han solucionado las comprobaciones de autorizaci\u00f3n necesarias para un usuario autenticado, que resultaban en un escalado de privilegios, en SAP Basis AS ABAP en SAP NetWeaver, del 700 al 750 y desde el 750, provistos como plataforma ABAP."}], "id": "CVE-2018-2494", "lastModified": "2019-10-03T00:03:26.223", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-12-11T22:29:00.377", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required", "Vendor Advisory"], "url": "https://launchpad.support.sap.com/#/notes/2698996"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}