The SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, has insufficient request validation (for example, where the reques…

published 2018-07-10 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-14294

cvss: 5.9; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.5%; EPSS 1.5% chance of exploitation in 30 days, percentile 75%
public exploits: 0; none known

The SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, has insufficient request validation (for example, where the request is validated for authenticity and validity) and under certain conditions, will process invalid requests. Several areas of the SAP Internet Graphics Server (IGS) did not require sufficient input validation. Namely, the SAP Internet Graphics Server (IGS) HTTP and RFC listener, SAP Internet Graphics Server (IGS) portwatcher when registering a portwatcher to the multiplexer and the SAP Internet Graphics Server (IGS) multiplexer had insufficient input validation and thus allowing a malformed data packet to cause a crash.

Exploit prediction

1.54% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.0	5.9	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:N/A:P

Affected products

SAP SAP Internet Graphics Server (IGS)

Classification

Weakness

CWE-20 Improper Input Validation

References

wiki.scn.sap.com /wiki/pages/viewpage.action?pageId=497256000
vendor-advisory
launchpad.support.sap.com /#/notes/2644147
permissions-required, vendor-advisory
securityfocus.com /bid/104708
vdb-entry, third-party-advisory

Sources

CVE List CVE-2018-2439
NVD CVE-2018-2439

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary