CVE-2018-2504

Published: Dec 11, 2018Modified: Nov 21, 2024

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting (XSS) vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50.

Affected (7)

Products: Sap: Netweaver Application Server Java

Sap

1 product

Netweaver Application Server Java

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Sap Netweaver Application Server Java	Version 7.10
Sap Netweaver Application Server Java	Version 7.11
Sap Netweaver Application Server Java	Version 7.20
Sap Netweaver Application Server Java	Version 7.30
Sap Netweaver Application Server Java	Version 7.31
Sap Netweaver Application Server Java	Version 7.40
Sap Netweaver Application Server Java	Version 7.50