CVE-2018-2392

high · 7.5

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server (IGS) to become unavailable.

7.5

CVSS

41.1%

EPSS (exploit prob.)

99th

EPSS percentile

2018-02-14

Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-611

Affected products

Vendor	Product	Affected versions
sap	internet_graphics_server	7.20
sap	internet_graphics_server	7.20ext
sap	internet_graphics_server	7.45
sap	internet_graphics_server	7.49
sap	internet_graphics_server	7.53

Check a specific version with /api/v1/cve/match.

References

https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
https://launchpad.support.sap.com/#/notes/2525222
https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
https://launchpad.support.sap.com/#/notes/2525222

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2018-2392