TI-2018-01748 Aliases CVE-2018-2360 GHSA-7jrj-4gj5-f734

Missing authentication in SAP Startup Service

LOW 38CWE-306Published 2018-01-09 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-306.

Summary

SAP Startup Service, SAP KERNEL 7.45, 7.49, and 7.52, is missing an authentication check for functionalities that require user identity and cause consumption of file system storage.

Why it matters now

EPSS 0.02506 84th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP Startup Service	7.45; 7.49; 7.52	—	No fix listed	CNA

SAP Startup Service VendorSAP Affected 7.45; 7.49; 7.52 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:o:sap:sap_kernel:7.45:::::::*	7.45	Vulnerable	SAP
cpe:2.3:o:sap:sap_kernel:7.49:::::::*	7.49	Vulnerable	SAP
cpe:2.3:o:sap:sap_kernel:7.52:::::::*	7.52	Vulnerable	SAP

cpe:2.3:o:sap:sap_kernel:7.45:*:*:*:*:*:*:* Versions 7.45 Vulnerable ·SAP
cpe:2.3:o:sap:sap_kernel:7.49:*:*:*:*:*:*:* Versions 7.49 Vulnerable ·SAP
cpe:2.3:o:sap:sap_kernel:7.52:*:*:*:*:*:*:* Versions 7.52 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2018-2360
2026-10-03 Alias added: GHSA-7jrj-4gj5-f734

References

Advisory 1

https://blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018/

Other 1

https://launchpad.support.sap.com/#/notes/2523961

TI-2017-12277 Improper authentication in SAP Trusted RFC connection CVSS 3.0HIGH 8.8
TI-2019-00299 SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22… CVSS 3.1HIGH 7.5
TI-2017-03910 The SAP Message Server HTTP daemon in SAP KERNEL 7.21-7.49 allows remote attackers to… CVSS 3.0HIGH 7.5
TI-2018-01815 SAP Gateway (SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64… CVSS 3.0HIGH 7.5
TI-2014-07786 Buffer overflow in the SAP NetWeaver Dispatcher in SAP Kernel 7.00 32-bit and 7.40 64-bit… CVSS 2.0MEDIUM 6.5
TI-2014-07785 Buffer overflow in the SAP NetWeaver Dispatcher in SAP Kernel 7.00 32-bit and 7.40 64-bit… CVSS 2.0MEDIUM 6.5

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences