CVE-2018-2428 describes an information disclosure vulnerability in SAP UI5 Handler, affecting SAP Infrastructure 1.0, SAP UI versions 7.4 through 7.52, and SAP UI for SAP NetWeaver 7.00 version 2.0. With a CVSS score of 5.3 (Medium), this vulnerability allows an unauthenticated attacker to access restricted information over the network with low attack complexity, resulting in a potential loss of confidentiality. There is no evidence of active exploitation, nor are public exploit codes available in Metasploit, Nuclei, or ExploitDB. While there is minimal community discussion and media coverage, SecurityWeek reported on SAP's critical updates addressing this and other security notes.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.0CPE matchmatch criteria | cpe:2.3:a:sap:infrastructure:1.0:*:*:*:*:*:*:* | ||
2.0CPE matchmatch criteria | cpe:2.3:a:sap:ui:2.0:*:*:*:*:netweaver_7.0:*:* | ||
7.4CPE matchmatch criteria | cpe:2.3:a:sap:ui:7.4:*:*:*:*:*:*:* | ||
7.5CPE matchmatch criteria | cpe:2.3:a:sap:ui:7.5:*:*:*:*:*:*:* | ||
7.51CPE matchmatch criteria | cpe:2.3:a:sap:ui:7.51:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.