CVE-2018-2454

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-09-11 · updated 2026-06-17
Weakness: CWE-862

Description

SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 (in business function EAFS_BCA_BUSOPR_2) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Affected products

SAP Enterprise Financial Services: 6.05, 6.06, 6.16, 6.17, 6.18, 8.0

References

http://www.securityfocus.com/bid/105316
https://launchpad.support.sap.com/#/notes/2645133
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993
http://www.securityfocus.com/bid/105316
https://launchpad.support.sap.com/#/notes/2645133
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993

Get alerted when CVE-2018-2454 or the next vulnerability affects your stack