Vulnerability Intelligence Report
CVE-2018-2424
SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to the DOM that could steal user information. Software components affected are: SAP Hana Database 1.00, 2.00; SAP UI5 1.00; SAP UI5 (Java) 7.30, 7.31, 7.40, 7,50; SAP UI 7.40, 7.50, 7.51, 7.52, and version 2.0 of SAP UI for SAP NetWeaver 7.00
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
Exploitability:3.9
Impact Score:5.9
EPSS Probability:2.40%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| SAP SE | SAP HANA Database | 1.0 (affected), 2.0 (affected) |
| SAP SE | SAP UI5 | 1.0 (affected) |
| SAP SE | SAP UI5(Java) | 7.3 (affected), 7.31 (affected), 7.40 (affected), 7.50 (affected) |
| SAP SE | SAP UI | 7.40 (affected), 7.50 (affected), 7.51 (affected), 7.52 (affected) |
| SAP SE | SAP UI for SAP NetWeaver 7.00 | 2.0 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
2.396%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | SAP SE · Vendor · Germany |
| Reserved | 2017-12-15T00:00:00 |
| Published | 2018-06-12T15:00:00 |
| Patch Date | 2018-06-12 |
| Last Updated | 2024-08-05T04:21:33 |
Community Chatter & Buzz