Vulnerability record · CVE-2018-2428 · published 12 June 2018

CVE-2018-2428: Sap infrastructure vulnerability

Sap · Infrastructure

Under certain conditions SAP UI5 Handler allows an attacker to access information which would otherwise be restricted. Software components affected are: SAP Infrastructure 1.0, SAP UI 7.4, 7.5, 7.51, 7.52 and version 2.0 of SAP UI for SAP NetWeaver 7.00.

5.3 CVSS 3.0 Medium EPSS 1.7% · top 23.2%

5.3CVSS 3.0 base score, v2 5.0

1.7%EPSS exploitation probability, 30 days

NoNot in CISA KEV

2Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Infrastructure Sap

Ui Sap

References

Link	Tags
http://www.securityfocus.com/bid/104446	Third Party AdvisoryVDB Entry
https://launchpad.support.sap.com/#/notes/2621121	Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=495289255	Vendor Advisory
http://www.securityfocus.com/bid/104446	Third Party AdvisoryVDB Entry
https://launchpad.support.sap.com/#/notes/2621121	Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=495289255	Vendor Advisory

Track CVE-2018-2428 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.2CVE-2023-33991Sap ui cross-site scripting vulnerabilitySAP UI5 Variant Management - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, does not sufficiently encode user-contr…EPSS 0.48%13 Jun 2023 7.5CVE-2018-2424Sap hana database improper input validation vulnerabilitySAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to th…EPSS 2.4%12 Jun 2018 5.3CVE-2019-0388Sap ui authentication bypass by spoofing vulnerabilitySAP UI5 HTTP Handler (corrected in SAP_UI versions 7.5, 7.51, 7.52, 7.53, 7.54 and SAP UI_700 version 2.0) allows an attacker to manipulate content d…EPSS 0.73%13 Nov 2019

Source: NIST National Vulnerability Database (record CVE-2018-2428), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.