CVE-2018-2452: XSS

Published Sep 11, 2018

Updated

The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting (XSS) vulnerability.

Affected Software

7 affected components

SAP NetWeaver Application Server Java=7.10

SAP NetWeaver Application Server Java=7.11

SAP NetWeaver Application Server Java=7.20

SAP NetWeaver Application Server Java=7.30

SAP NetWeaver Application Server Java=7.31

SAP NetWeaver Application Server Java=7.40

SAP NetWeaver Application Server Java=7.50

Event History

Sep 11, 2018

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2018-2452?

CVE-2018-2452 is a cross-site scripting (XSS) vulnerability in the logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50.

How severe is CVE-2018-2452?

CVE-2018-2452 has a severity rating of 6.1, which is considered medium.

Which software versions are affected by CVE-2018-2452?

CVE-2018-2452 affects SAP NetWeaver AS Java versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50.

What is the impact of CVE-2018-2452?

CVE-2018-2452 allows attackers to inject malicious scripts into web pages viewed by users, potentially leading to unauthorized actions or data theft.

How can I fix CVE-2018-2452?

To fix CVE-2018-2452, it is recommended to apply the necessary security patches provided by SAP.