← Vulnerability feed

Vulnerability record · CVE-2018-2478 · published 13 November 2018

CVE-2018-2478: Sap basis vulnerability

Sap · Basis

An attacker can use specially crafted inputs to execute commands on the host of a TREX / BWA installation, SAP Basis, versions: 7.0 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40 and 7.50 to 7.53. Not all commands are possible, only those that can be executed by the <sid>adm user. The commands executed depend upon the privileges of the <sid>adm user.

7.2 CVSS 3.0 High EPSS 1.8% · top 22.0%
7.2CVSS 3.0 base score, v2 6.5
1.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

An attacker can use specially crafted inputs to execute commands on the host of a TREX / BWA installation, SAP Basis, versions: 7.0 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40 and 7.50 to 7.53. Not all commands are possible, only those that can be executed by the <sid>adm user. The commands executed depend upon the privileges of the <sid>adm user.

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/105904 Third Party AdvisoryVDB Entry
https://launchpad.support.sap.com/#/notes/2675696 Permissions RequiredVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832 Vendor Advisory
http://www.securityfocus.com/bid/105904 Third Party AdvisoryVDB Entry
https://launchpad.support.sap.com/#/notes/2675696 Permissions RequiredVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832 Vendor Advisory

Track CVE-2018-2478 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2022-41264Sap basis code injection vulnerabilityDue to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 791, allow…EPSS 0.89%5.9CVE-2019-0248Sap netweaver vulnerabilityUnder certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker to acces…EPSS 1.6%5.4CVE-2023-29110Sap abap platform cross-site scripting vulnerabilityThe SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, applicati…EPSS 0.32%4.6CVE-2023-29109Sap abap platform csv injection vulnerabilityThe SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, appl…EPSS 0.32%4.3CVE-2020-6307Sap basis incorrect authorization vulnerabilityAutomated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) does not perform sufficient auth…EPSS 0.72%

Source: NIST National Vulnerability Database (record CVE-2018-2478), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.