MEDIUMβœ“ PATCHπŸ‡΅πŸ‡± Wersja polska

CVE-2018-2415

CVSS 4.7v3.0pub. 2018-05-09upd. 2024-11-21

SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30, 7.31, 7.40, 7.50) do not sufficiently encode user controlled inputs, resulting in a content spoofing vulnerability when error pages are displayed.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

  • Sap J2ee Engine Server Core

    APP
    Sap
    7.117.307.317.407.50

  • Sap Netweaver Java Web Container And Http Service Engine

    APP
    Sap
    7.107.117.307.317.407.50
🟒
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Container
CWE
References

Related vulnerabilities

CVE-2025-42999CRITICAL9.1⚠ KEVPL βœ“ten sam vendor

SAP NetWeaver Visual Composer β€” niebezpieczna deserializacja treΕ›ci

CVE-2025-31324CRITICAL10.0⚠ KEVPL βœ“ten sam vendor

SAP NetWeaver: nieautoryzowany upload plikΓ³w wykonywalnych w Visual Composer

CVE-2022-22536CRITICAL10.0⚠ KEVten sam vendor

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Serve...

CVE-2021-38163CRITICAL9.9⚠ KEVten sam vendor

SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker aut...

CVE-2020-6287CRITICAL10.0⚠ KEVten sam vendor

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authen...

CVE-2018-2415 β€” Sap β€” J2Ee Engine Server Core β€” MEDIUM β€” CVSS 4.7 | CVEbaza.pl