CVE-2018-2415

Published: May 9, 2018Modified: Nov 21, 2024

4.7

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30, 7.31, 7.40, 7.50) do not sufficiently encode user controlled inputs, resulting in a content spoofing vulnerability when error pages are displayed.

Affected (11)

Products: Sap: Netweaver Java Web Container And Http Service Engine, J2ee Engine Server Core

Sap

2 products

Netweaver Java Web Container And Http Service Engine

J2ee Engine Server Core

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Sap Netweaver Java Web Container And Http Service Engine	Version 7.10
Sap Netweaver Java Web Container And Http Service Engine	Version 7.11
Sap Netweaver Java Web Container And Http Service Engine	Version 7.30
Sap Netweaver Java Web Container And Http Service Engine	Version 7.31
Sap Netweaver Java Web Container And Http Service Engine	Version 7.40
Sap Netweaver Java Web Container And Http Service Engine	Version 7.50

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Sap J2ee Engine Server Core	Version 7.11
Sap J2ee Engine Server Core	Version 7.30
Sap J2ee Engine Server Core	Version 7.31
Sap J2ee Engine Server Core	Version 7.40
Sap J2ee Engine Server Core	Version 7.50