CVE-2018-2503 describes a critical access control vulnerability in the SAP NetWeaver AS Java keystore service, affecting versions 7.11 through 7.50. This flaw allows unauthorized access to protected resources due to insufficient restrictions. With a CVSS score of 7.4 (High), it presents a significant risk, as an unauthenticated attacker on an adjacent network can achieve high confidentiality impact without user interaction. Despite its severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or KEV listing. Community discussion and media coverage are minimal, with only one article from SecurityWeek noting a patch release.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
7.11CPE matchmatch criteria | cpe:2.3:a:sap:netweaver_application_server_java:7.11:*:*:*:*:*:*:* | ||
7.20CPE matchmatch criteria | cpe:2.3:a:sap:netweaver_application_server_java:7.20:*:*:*:*:*:*:* | ||
7.30CPE matchmatch criteria | cpe:2.3:a:sap:netweaver_application_server_java:7.30:*:*:*:*:*:*:* | ||
7.31CPE matchmatch criteria | cpe:2.3:a:sap:netweaver_application_server_java:7.31:*:*:*:*:*:*:* | ||
7.40CPE matchmatch criteria | cpe:2.3:a:sap:netweaver_application_server_java:7.40:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.