Vulnerability record · CVE-2018-2424 · published 12 June 2018

CVE-2018-2424: Sap hana database improper input validation vulnerability

Sap · Hana Database

SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to the DOM that could steal user information. Software components affected are: SAP Hana Database 1.00, 2.00; SAP UI5 1.00; SAP UI5 (Java) 7.30, 7.31, 7.40, 7,50; SAP UI 7.40, 7.50, 7.51, 7.52, and version 2.0 of SAP UI for SAP NetWeaver 7.00

7.5 CVSS 3.0 High EPSS 2.4% · top 16.9% CWE-20 · Improper input validation

7.5CVSS 3.0 base score, v2 5.0

2.4%EPSS exploitation probability, 30 days

NoNot in CISA KEV

4Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Hana Database Sap

Ui Sap

Ui5 Sap

Ui5 Java Sap

References

Link	Tags
http://www.securityfocus.com/bid/104459	Third Party AdvisoryVDB Entry
https://launchpad.support.sap.com/#/notes/2538856	Permissions RequiredVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=495289255	Vendor Advisory
http://www.securityfocus.com/bid/104459	Third Party AdvisoryVDB Entry
https://launchpad.support.sap.com/#/notes/2538856	Permissions RequiredVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=495289255	Vendor Advisory

Track CVE-2018-2424 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-40309Sap commoncryptolib incorrect authorization vulnerabilitySAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated …EPSS 0.88%12 Sep 2023 8.8CVE-2026-0492Sap hana database missing authentication for critical function vulnerabilitySAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially…EPSS 0.33%13 Jan 2026 8.2CVE-2023-33991Sap ui cross-site scripting vulnerabilitySAP UI5 Variant Management - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, does not sufficiently encode user-contr…EPSS 0.48%13 Jun 2023 7.5CVE-2023-40308Sap commoncryptolib out-of-bounds write vulnerabilitySAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a…EPSS 0.75%12 Sep 2023 7.5CVE-2019-0350Sap hana database vulnerabilitySAP HANA Database, versions 1.0, 2.0, allows an unauthorized attacker to send a malformed connection request, which crashes the indexserver of an SAP…EPSS 1.1%4 Nov 2019 7.5CVE-2019-0319Sap gateway injection vulnerabilityThe SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attac…EPSS 2.5%10 Jul 2019 6.5CVE-2021-21474Sap hana database inadequate encryption strength vulnerabilitySAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML Assertion is…EPSS 0.70%9 Feb 2021 6.1CVE-2021-21476Sap ui5 open redirect vulnerabilitySAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect users to a…EPSS 0.82%9 Feb 2021

Source: NIST National Vulnerability Database (record CVE-2018-2424), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.