CVE-2018-2478: sap basis
Vulnerability summary
CVE-2018-2478 is a high (CVSS 7.2) vulnerability in sap basis. EPSS estimates a 1.83% chance of exploitation in the next 30 days, higher than 78.6% of scored vulnerabilities.
Timeline
- 13-11-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An attacker can use specially crafted inputs to execute commands on the host of a TREX / BWA installation, SAP Basis, versions: 7.0 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40 and 7.50 to 7.53. Not all commands are possible, only those that can be executed by the <sid>adm user. The commands executed depend upon the privileges of the <sid>adm user.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.83%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
+0.27 pp
From 1.56% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Sap2 products
- basis≥ 7.0, ≤ 7.02 | ≥ 7.10, ≤ 7.11 | ≥ 7.50, ≤ 7.53 | 7.30 | 7.31 | 7.40
- sap basis (trex / bwa installation)= 7.0 to 7.02 | = 7.10 to 7.11 | = 7.30 | = 7.31 | = 7.40 | = 7.50 to 7.53
1 vendor · 2 products