CVE-2018-17865: XSS
UNSUPPORTED WHEN ASSIGNED A cross-site scripting (XSS) vulnerability in SAP J2EE Engine 7.01 allows remote attackers to inject arbitrary web script via the wsdlPath parameter to /ctcprotocol/Protocol. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this cross-site scripting (XSS) vulnerability?
The vulnerability ID is CVE-2018-17865.
What is the severity level of CVE-2018-17865?
The severity level of CVE-2018-17865 is medium, with a CVSS score of 6.1.
How does the CVE-2018-17865 vulnerability occur?
The CVE-2018-17865 vulnerability occurs due to a cross-site scripting (XSS) vulnerability in the SAP J2EE Engine 7.01, allowing remote attackers to inject arbitrary web script.
How can the CVE-2018-17865 vulnerability be exploited?
The CVE-2018-17865 vulnerability can be exploited by sending malicious input as the wsdlPath parameter to /ctcprotocol/Protocol.
Is there a fix available for CVE-2018-17865?
Since the vulnerability affects products that are no longer supported by the maintainer, there might not be an official fix available. However, it is recommended to implement mitigations, such as input validation and output encoding, to prevent exploitation of the vulnerability.