CVE-2018-2363: sap_se sap netweaver Code Injection
Vulnerability summary
CVE-2018-2363 is a high (CVSS 8.8) Code Injection vulnerability in sap_se sap netweaver. EPSS estimates a 1.67% chance of exploitation in the next 30 days, higher than 76.6% of scored vulnerabilities.
Timeline
- 09-01-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user's choice. A malicious user can therefore control the behaviour of the system or can potentially escalate privileges by executing malicious code without legitimate credentials.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.67%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
+0.31 pp
From 1.36% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Sap2 products
- business_application_software_integrated_solution≥ 7.00, ≤ 7.02 | ≥ 7.10, ≤ 7.11 | ≥ 7.50, ≤ 7.52 | 7.30 | 7.31 | 7.40
- netweaverna
Sap_se1 product
- sap netweaver7.00 | 7.02 | 7.10 | 7.11 | 7.30 | 7.31 | 7.40 | 7.50 | 7.52
2 vendors · 3 products