TI-2018-01791 Aliases CVE-2018-2403 GHSA-f456-7m27-wjmp

Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access…

LOW 31Published 2018-04-10 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access information which would otherwise be restricted. It is possible for an authorized user to get SAP Disclosure Management to point a specific chapter type to a chapter the user has not been given access to.

Why it matters now

EPSS 0.01132 66th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP Disclosure Management	10.1	—	No fix listed	CNA

SAP Disclosure Management VendorSAP Affected 10.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:disclosure_management:10.1:::::::*	10.1	Vulnerable	SAP

cpe:2.3:a:sap:disclosure_management:10.1:*:*:*:*:*:*:* Versions 10.1 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2018-2403
2026-10-03 Alias added: GHSA-f456-7m27-wjmp

References

Advisory 1

https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018/

Other 1

https://launchpad.support.sap.com/#/notes/2595800

TI-2018-01792 SAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation. CVSS 3.0CRITICAL 9.8
TI-2019-00224 Missing authorization in SAP Disclosure Management CVSS 3.0HIGH 8.8
TI-2018-01799 Missing authorization in SAP Disclosure Management CVSS 3.0HIGH 8.8
TI-2018-01798 Missing authorization in SAP Disclosure Management CVSS 3.0HIGH 8.8
TI-2020-05144 Insufficient session expiration in SAP Disclosure Management CVSS 3.1HIGH 8.8
TI-2020-05143 Insufficient session expiration in SAP Disclosure Management CVSS 3.1HIGH 8.8

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences