The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting (XSS) vulnerability.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/bid/105325 | Third Party Advisory VDB Entry |
| https://launchpad.support.sap.com/#/notes/2623846 | Permissions Required |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
20 Apr 2021, 19:13
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:sap:netweaver:7.10:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver:7.31:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver:7.50:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver:7.30:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver:7.20:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver:7.40:*:*:*:*:*:*:* |
cpe:2.3:a:sap:netweaver_application_server_java:7.10:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_java:7.31:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_java:7.30:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_java:7.20:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_java:7.40:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_java:7.11:*:*:*:*:*:*:* |
Information
Published : 2018-09-11 15:29
Updated : 2023-12-10 12:44
NVD link : CVE-2018-2452
Mitre link : CVE-2018-2452
CVE.ORG link : CVE-2018-2452
JSON object : View
Products Affected
sap
- netweaver_application_server_java
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')