Read the docs
TI-2018-01862 Aliases CVE-2018-2484GHSA-7965-5qv7-w6h8

Missing authorization in SAP Enterprise Financial Services

Priority MEDIUM 41CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0; Bank/CFM 4.63_20) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Why it matters now

EPSS 0.01373 72nd percentileScored 2026-11-07
Fix Fixed SAP Enterprise Financial Services (SAPSCORE) (SAP SE): 1.13, 1.14, 1.15SAP Enterprise Financial Services (S4CORE) (SAP SE): 1.01, 1.02, 1.03+2 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP Enterprise Financial Services (SAPSCORE)before 1.13; before 1.14; before 1.151.13, 1.14, 1.15Patch availableCNA
SAPSAP Enterprise Financial Services (S4CORE)before 1.01; before 1.02; before 1.031.01, 1.02, 1.03Patch availableCNA
SAPSAP Enterprise Financial Services (EA-FINSERV)before 1.10; before 2.0; before 5.0; before 6.0; before 6.03; before 6.04; before 6.05; before 6.06; before 6.16; before 6.17; before 6.18; before 8.01.10, 2.0, 5.0, 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0Patch availableCNA
SAPSAP Enterprise Financial Services (Bank/CFM)before 4.63_204.63_20Patch availableCNA
  • SAP Enterprise Financial Services (SAPSCORE) VendorSAP Affected before 1.13; before 1.14; before 1.15 Fixed in 1.13, 1.14, 1.15 Patch available CNA
  • SAP Enterprise Financial Services (S4CORE) VendorSAP Affected before 1.01; before 1.02; before 1.03 Fixed in 1.01, 1.02, 1.03 Patch available CNA
  • SAP Enterprise Financial Services (EA-FINSERV) VendorSAP Affected before 1.10; before 2.0; before 5.0; before 6.0; before 6.03; before 6.04; before 6.05; before 6.06; before 6.16; before 6.17; before 6.18; before 8.0 Fixed in 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 Patch available CNA
  • SAP Enterprise Financial Services (Bank/CFM) VendorSAP Affected before 4.63_20 Fixed in 4.63_20 Patch available CNA

CPE configurations NVD · 19

CPEVersionsRoleVendor
cpe:2.3:a:sap:sapscore:1.13:*:*:*:*:*:*:*1.13VulnerableSAP
cpe:2.3:a:sap:sapscore:1.14:*:*:*:*:*:*:*1.14VulnerableSAP
cpe:2.3:a:sap:sapscore:1.15:*:*:*:*:*:*:*1.15VulnerableSAP
cpe:2.3:a:sap:s4core:1.01:*:*:*:*:*:*:*1.01VulnerableSAP
cpe:2.3:a:sap:s4core:1.02:*:*:*:*:*:*:*1.02VulnerableSAP
cpe:2.3:a:sap:s4core:1.03:*:*:*:*:*:*:*1.03VulnerableSAP
cpe:2.3:a:sap:ea-finserv:1.10:*:*:*:*:*:*:*1.10VulnerableSAP
cpe:2.3:a:sap:ea-finserv:2.0:*:*:*:*:*:*:*2.0VulnerableSAP
cpe:2.3:a:sap:ea-finserv:5.0:*:*:*:*:*:*:*5.0VulnerableSAP
cpe:2.3:a:sap:ea-finserv:6.0:*:*:*:*:*:*:*6.0VulnerableSAP
  • cpe:2.3:a:sap:sapscore:1.13:*:*:*:*:*:*:* Versions 1.13 Vulnerable ·SAP
  • cpe:2.3:a:sap:sapscore:1.14:*:*:*:*:*:*:* Versions 1.14 Vulnerable ·SAP
  • cpe:2.3:a:sap:sapscore:1.15:*:*:*:*:*:*:* Versions 1.15 Vulnerable ·SAP
  • cpe:2.3:a:sap:s4core:1.01:*:*:*:*:*:*:* Versions 1.01 Vulnerable ·SAP
  • cpe:2.3:a:sap:s4core:1.02:*:*:*:*:*:*:* Versions 1.02 Vulnerable ·SAP
  • cpe:2.3:a:sap:s4core:1.03:*:*:*:*:*:*:* Versions 1.03 Vulnerable ·SAP
  • cpe:2.3:a:sap:ea-finserv:1.10:*:*:*:*:*:*:* Versions 1.10 Vulnerable ·SAP
  • cpe:2.3:a:sap:ea-finserv:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·SAP
  • cpe:2.3:a:sap:ea-finserv:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·SAP
  • cpe:2.3:a:sap:ea-finserv:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·SAP
Show 9 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:ea-finserv:6.03:*:*:*:*:*:*:*6.03VulnerableSAP
cpe:2.3:a:sap:ea-finserv:6.04:*:*:*:*:*:*:*6.04VulnerableSAP
cpe:2.3:a:sap:ea-finserv:6.05:*:*:*:*:*:*:*6.05VulnerableSAP
cpe:2.3:a:sap:ea-finserv:6.06:*:*:*:*:*:*:*6.06VulnerableSAP
cpe:2.3:a:sap:ea-finserv:6.16:*:*:*:*:*:*:*6.16VulnerableSAP
cpe:2.3:a:sap:ea-finserv:6.17:*:*:*:*:*:*:*6.17VulnerableSAP
cpe:2.3:a:sap:ea-finserv:6.18:*:*:*:*:*:*:*6.18VulnerableSAP
cpe:2.3:a:sap:ea-finserv:8.0:*:*:*:*:*:*:*8.0VulnerableSAP
cpe:2.3:a:sap:bank\/cfm:4.63_20:*:*:*:*:*:*:*4.63_20VulnerableSAP
  • cpe:2.3:a:sap:ea-finserv:6.03:*:*:*:*:*:*:* Versions 6.03 Vulnerable ·SAP
  • cpe:2.3:a:sap:ea-finserv:6.04:*:*:*:*:*:*:* Versions 6.04 Vulnerable ·SAP
  • cpe:2.3:a:sap:ea-finserv:6.05:*:*:*:*:*:*:* Versions 6.05 Vulnerable ·SAP
  • cpe:2.3:a:sap:ea-finserv:6.06:*:*:*:*:*:*:* Versions 6.06 Vulnerable ·SAP
  • cpe:2.3:a:sap:ea-finserv:6.16:*:*:*:*:*:*:* Versions 6.16 Vulnerable ·SAP
  • cpe:2.3:a:sap:ea-finserv:6.17:*:*:*:*:*:*:* Versions 6.17 Vulnerable ·SAP
  • cpe:2.3:a:sap:ea-finserv:6.18:*:*:*:*:*:*:* Versions 6.18 Vulnerable ·SAP
  • cpe:2.3:a:sap:ea-finserv:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·SAP
  • cpe:2.3:a:sap:bank\/cfm:4.63_20:*:*:*:*:*:*:* Versions 4.63_20 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP Enterprise Financial Services (SAPSCORE) (SAP SE) Fixed in 1.13, 1.14, 1.15
  • Fix · CNA SAP Enterprise Financial Services (S4CORE) (SAP SE) Fixed in 1.01, 1.02, 1.03
  • Fix · CNA SAP Enterprise Financial Services (EA-FINSERV) (SAP SE) Fixed in 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0
  • Fix · CNA SAP Enterprise Financial Services (Bank/CFM) (SAP SE) Fixed in 4.63_20

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-2484
  2. 2026-10-03 Alias added: GHSA-7965-5qv7-w6h8

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences