{"id":"CVE-2018-8518","aliases":["EUVD-2018-20142","GHSA-g49q-72gp-cj2r","SUSE-SU-2022:0142-1","SUSE-SU-2022:0183-1"],"status":"published","title":"An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly...","description":"An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka \"Microsoft SharePoint Elevation of Privilege Vulnerability.\" This affects Microsoft SharePoint. This CVE ID is unique from CVE-2018-8480, CVE-2018-8488, CVE-2018-8498.","severity":{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02813,"percentile":0.86625,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2018-10-10T13:00:00Z","modified":"2026-06-17T02:05:02Z","affected":[{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-2.82.1"}]}],"bundled":72},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-2.82.1"}]}],"bundled":72},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-2.82.1"}]}],"bundled":72},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-2.82.1"}]}],"bundled":72},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-2.82.1"}]}],"bundled":72},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-2.82.1"}]}],"bundled":72},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-2.82.1"}]}],"bundled":72},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-2.82.1"}]}],"bundled":72},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-2.82.1"}]}],"bundled":72},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-2.82.1"}]}],"bundled":72},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-2.82.1"}]}],"bundled":72},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-2.82.1"}]}],"bundled":72},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-2.82.1"}]}],"bundled":72},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-2.82.1"}]}],"bundled":72},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-3.92.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-3.92.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-3.92.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-3.92.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-3.92.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-3.92.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-3.92.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-3.92.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-3.92.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.3-3.92.1"}]}],"bundled":53}],"products":[{"vendor":"microsoft","product":"microsoft sharepoint"},{"vendor":"microsoft","product":"sharepoint_enterprise_server"}],"references":[{"url":"http://www.securityfocus.com/bid/105496","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8518","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.securitytracker.com/id/1041835","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8518"},{"url":"https://github.com/advisories/GHSA-g49q-72gp-cj2r"},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220142-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1194019","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8707","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-1765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-1788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-1817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-1820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-1825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-1826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-1844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-1871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30897","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220183-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-8518","description":"An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka \"Microsoft SharePoint Elevation of Privilege Vulnerability.\" This affects Microsoft SharePoint. This CVE ID is unique from CVE-2018-8480, CVE-2018-8488, CVE-2018-8498.","status":"published","published":"2018-10-10T13:00:00Z","modified":"2024-08-05T07:02:24.447Z","updated_at":"2026-11-02T14:35:04.172099Z"}],"euvd":[{"id":"EUVD-2018-20142","description":"An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka \"Microsoft SharePoint Elevation of Privilege Vulnerability.\" This affects Microsoft SharePoint. This CVE ID is unique from CVE-2018-8480, CVE-2018-8488, CVE-2018-8498.","status":"published","published":"2018-10-10T13:00:00Z","modified":"2024-08-05T07:02:24Z","updated_at":"2026-11-03T02:40:02.600498Z"}],"ghsa":[{"id":"GHSA-g49q-72gp-cj2r","title":"An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly...","description":"An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka \"Microsoft SharePoint Elevation of Privilege Vulnerability.\" This affects Microsoft SharePoint. This CVE ID is unique from CVE-2018-8480, CVE-2018-8488, CVE-2018-8498.","status":"published","published":"2022-05-13T01:53:44Z","modified":"2023-02-02T05:02:28Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:51:26.673587Z"}],"nvd":[{"id":"CVE-2018-8518","description":"An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka \"Microsoft SharePoint Elevation of Privilege Vulnerability.\" This affects Microsoft SharePoint. This CVE ID is unique from CVE-2018-8480, CVE-2018-8488, CVE-2018-8498.","status":"published","published":"2018-10-10T13:29:05.917Z","modified":"2026-06-17T02:05:02.38Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:44.873741Z"}],"osv":[{"id":"SUSE-SU-2022:0142-1","title":"Security update for webkit2gtk3","description":"This update for webkit2gtk3 fixes the following issues:\n\n- Update to version 2.34.3 (bsc#1194019).\n- CVE-2021-30887: Fixed logic issue allowing unexpectedly unenforced Content Security Policy when processing maliciously crafted web content.\n- CVE-2021-30890: Fixed logic issue allowing universal cross site scripting when processing maliciously crafted web content.\n","status":"published","published":"2022-01-20T13:15:21Z","modified":"2026-02-04T02:37:37.751925Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0183-1","title":"Security update for webkit2gtk3","description":"This update for webkit2gtk3 fixes the following issues:\n\n- Update to version 2.34.3 (bsc#1194019).\n- CVE-2021-30887: Fixed logic issue allowing unexpectedly unenforced Content Security Policy when processing maliciously crafted web content.\n- CVE-2021-30890: Fixed logic issue allowing universal cross site scripting when processing maliciously crafted web content.\n","status":"published","published":"2022-01-25T17:19:19Z","modified":"2026-02-04T03:48:53.89933Z","updated_at":"2026-11-02T15:53:50.066806Z"}]}}