{"id":"CVE-2018-2363","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-2363","generatedAt":"2026-10-29T00:56:52.619Z","title":"SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user's choice.","description":"SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user's choice. A malicious user can therefore control the behaviour of the system or can potentially escalate privileges by executing malicious code without legitimate credentials.","published":"2018-01-09T15:29:00.000Z","lastModified":"2026-06-17T01:55:34.000Z","status":"Modified","sourceIdentifier":"cna@sap.com","cvss":{"version":"3.0","score":8.8,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-94"],"affected":["sap/netweaver","sap/business application software integrated solution"],"epss":{"score":0.01672,"percentile":0.76695,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (1.67%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"http://www.securityfocus.com/bid/102449","tags":["Third Party Advisory","VDB Entry"],"source":"cna@sap.com"},{"url":"https://blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018/","tags":["Vendor Advisory"],"source":"cna@sap.com"},{"url":"https://launchpad.support.sap.com/#/notes/1906212","tags":["Permissions Required"],"source":"cna@sap.com"},{"url":"https://launchpad.support.sap.com/#/notes/2525392","tags":["Permissions Required"],"source":"cna@sap.com"},{"url":"http://www.securityfocus.com/bid/102449","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018/","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://launchpad.support.sap.com/#/notes/1906212","tags":["Permissions Required"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://launchpad.support.sap.com/#/notes/2525392","tags":["Permissions Required"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-2363","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}