SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting (XSS) vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/bid/106150 | Third Party Advisory VDB Entry |
| https://launchpad.support.sap.com/#/notes/2718993 | Permissions Required |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Apr 2021, 12:30
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:sap:netweaver:7.10:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver:7.31:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver:7.50:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver:7.30:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver:7.20:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver:7.40:*:*:*:*:*:*:* |
cpe:2.3:a:sap:netweaver_application_server_java:7.10:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_java:7.31:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_java:7.30:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_java:7.20:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_java:7.40:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_java:7.11:*:*:*:*:*:*:* |
Information
Published : 2018-12-11 22:29
Updated : 2023-12-10 12:44
NVD link : CVE-2018-2504
Mitre link : CVE-2018-2504
CVE.ORG link : CVE-2018-2504
JSON object : View
Products Affected
sap
- netweaver_application_server_java
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')