MEDIUM✓ PATCH🇬🇧 English

CVE-2018-2415

CVSS 4.7v3.0pub. 2018-05-09upd. 2024-11-21

SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30, 7.31, 7.40, 7.50) do not sufficiently encode user controlled inputs, resulting in a content spoofing vulnerability when error pages are displayed.

oryginał EN
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

  • Sap J2ee Engine Server Core

    APP
    Sap
    7.117.307.317.407.50

  • Sap Netweaver Java Web Container And Http Service Engine

    APP
    Sap
    7.107.117.307.317.407.50
🟢
PATCH DOSTĘPNY
Aktualizacja od producenta gotowa. Wdrożenie w ramach standardowego cyklu.
Tagi
Container
CWE
Referencje

Powiązane podatności

CVE-2025-42999CRITICAL9.1⚠ KEVPL ✓ten sam vendor

SAP NetWeaver Visual Composer — niebezpieczna deserializacja treści

CVE-2025-31324CRITICAL10.0⚠ KEVPL ✓ten sam vendor

SAP NetWeaver: nieautoryzowany upload plików wykonywalnych w Visual Composer

CVE-2022-22536CRITICAL10.0⚠ KEVten sam vendor

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Serve...

CVE-2021-38163CRITICAL9.9⚠ KEVten sam vendor

SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker aut...

CVE-2020-6287CRITICAL10.0⚠ KEVten sam vendor

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authen...