{"api_version":"1","generated_at":"2026-07-24T01:39:40+00:00","cve":"CVE-2018-2494","urls":{"html":"https://cve.report/CVE-2018-2494","api":"https://cve.report/api/cve/CVE-2018-2494.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-2494","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-2494"},"summary":{"title":"CVE-2018-2494","description":"Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP Basis AS ABAP of SAP NetWeaver 700 to 750, from 750 onwards delivered as ABAP Platform.","state":"PUBLIC","assigner":"cna@sap.com","published_at":"2018-12-11 22:29:00","updated_at":"2019-10-03 00:03:00"},"problem_types":["CWE-863"],"metrics":[],"references":[{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699","name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699","refsource":"MISC","tags":["Vendor Advisory"],"title":"SAP Security Patch Day – December 2018 - Product Security Response at SAP - SCN Wiki","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://launchpad.support.sap.com/#/notes/2698996","name":"https://launchpad.support.sap.com/#/notes/2698996","refsource":"MISC","tags":["Permissions Required","Vendor Advisory"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-2494","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-2494","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"2494","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"business_application_software_integrated_solution","cpe6":"7.31","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"2494","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"business_application_software_integrated_solution","cpe6":"7.40","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"2494","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"business_application_software_integrated_solution","cpe6":"7.31","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"2494","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"business_application_software_integrated_solution","cpe6":"7.40","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"2494","vulnerable":"1","versionEndIncluding":"7.02","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"business_application_software_integrated_solution","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"2494","vulnerable":"1","versionEndIncluding":"7.30","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"business_application_software_integrated_solution","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"2494","vulnerable":"1","versionEndIncluding":"7.53","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"business_application_software_integrated_solution","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cna@sap.com","ID":"CVE-2018-2494","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"SAP Basis (AS ABAP of SAP NetWeaver)","version":{"version_data":[{"version_name":"=","version_value":"7.00 to 7.02"},{"version_name":"=","version_value":"7.10 to 7.30"},{"version_name":"=","version_value":"7.31"},{"version_name":"=","version_value":"7.40"}]}},{"product_name":"SAP Basis (ABAP Platform)","version":{"version_data":[{"version_name":"=","version_value":"7.50 to 7.53"}]}}]},"vendor_name":"SAP"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP Basis AS ABAP of SAP NetWeaver 700 to 750, from 750 onwards delivered as ABAP Platform."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Missing Authorization Check"}]}]},"references":{"reference_data":[{"name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699","refsource":"MISC","url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699"},{"name":"https://launchpad.support.sap.com/#/notes/2698996","refsource":"MISC","url":"https://launchpad.support.sap.com/#/notes/2698996"}]},"source":{"discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2018-12-11 22:29:00","lastModifiedDate":"2019-10-03 00:03:00","problem_types":["CWE-863"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8,"baseSeverity":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.5},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*","versionStartIncluding":"7.00","versionEndIncluding":"7.02","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:business_application_software_integrated_solution:7.31:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:business_application_software_integrated_solution:7.40:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*","versionStartIncluding":"7.10","versionEndIncluding":"7.30","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*","versionStartIncluding":"7.50","versionEndIncluding":"7.53","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"2494","Ordinal":"118049","Title":"CVE-2018-2494","CVE":"CVE-2018-2494","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"2494","Ordinal":"1","NoteData":"Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP Basis AS ABAP of SAP NetWeaver 700 to 750, from 750 onwards delivered as ABAP Platform.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"2494","Ordinal":"2","NoteData":"2018-12-11","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"2494","Ordinal":"3","NoteData":"2018-12-11","Type":"Other","Title":"Modified"}]}}}