SAP Business Application Software Integrated Solution vulnerabilities

6 CVEs affecting SAP Business Application Software Integrated Solution, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-0279, published 2019-04-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-2367, published 2018-03-01. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. ABAP File Interface in, SAP BASIS, from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker to exploit insufficient validation of path information provided by…
CVE-2018-2363, published 2018-01-09. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user's choice. A malicious…
CVE-2017-16682, published 2017-12-12. High severity, CVSS 7.2. EPSS: 1.6% chance of exploitation in the next 30 days. SAP NetWeaver Internet Transaction Server (ITS), SAP Basis from 7.00 to 7.02, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker with administrator credentials to inject code that can be…
CVE-2017-16691, published 2017-12-12. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally signed note file of type 'SAR'. The digital signature…
CVE-2019-0279, published 2019-04-10. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versions 7.0 to 7.02, 7.10 to 7.30, 7.31, 7.40, 7.50 to 7.53) do…
CVE-2018-2494, published 2018-12-11. High severity, CVSS 8.0. EPSS: 0.8% chance of exploitation in the next 30 days. Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP Basis AS ABAP of SAP NetWeaver 700 to 750, from 750 onwards delivered as ABAP…