What is CVE-2018-2503?

CVE-2018-2503 is a high-severity vulnerability in Sap Netweaver Application Server Java, classified under Missing Authorization. CVSS score: 7.4/10. Published 2018-12-11.

How severe is CVE-2018-2503?

High severity. CVSS v3 base score is 7.4 out of 10.

Auth bypass in Sap Netweaver Application Server Java

CVE-2018-2503

By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected. This has been fixed in SAP NetWeaver AS Java (ServerCore versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50).

Vulnerability class: Broken Access Control

EPSS: 0.006 (42.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.

Affected products

Sap Netweaver_application_server_java — versions 7.11, 7.20, 7.30
Sap Netweaver As Java (Servercore) — versions = 7.11, = 7.20, = 7.30

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

cna@sap.com (x_refsource_MISC, Vendor Advisory)
cna@sap.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
cna@sap.com (Permissions Required, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-2503?: CVE-2018-2503 is a high-severity vulnerability in Sap Netweaver Application Server Java, classified under Missing Authorization. CVSS score: 7.4/10. Published 2018-12-11.
How severe is CVE-2018-2503?: High severity. CVSS v3 base score is 7.4 out of 10.