CVE-2018-2462: Input Validation
First published: Tue Sep 11 2018(Updated: )
In certain cases, BEx Web Java Runtime Export Web Service in SAP NetWeaver BI 7.30, 7.31. 7.40, 7.41, 7.50, does not sufficiently validate an XML document accepted from an untrusted source.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP NetWeaver | =7.30 | |
| SAP NetWeaver | =7.31 | |
| SAP NetWeaver | =7.40 | |
| SAP NetWeaver | =7.41 | |
| SAP NetWeaver | =7.50 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-2462?
CVE-2018-2462 is a vulnerability in the BEx Web Java Runtime Export Web Service in SAP NetWeaver BI.
What is the severity of CVE-2018-2462?
The severity of CVE-2018-2462 is high with a CVSS score of 8.8.
Which versions of SAP NetWeaver BI are affected by CVE-2018-2462?
SAP NetWeaver BI 7.30, 7.31, 7.40, 7.41, and 7.50 are affected by CVE-2018-2462.
How does CVE-2018-2462 impact SAP NetWeaver BI?
CVE-2018-2462 allows an attacker to execute arbitrary code on the affected system if a malicious XML document is accepted from an untrusted source.
How can I fix CVE-2018-2462?
To fix CVE-2018-2462, apply the necessary security patches provided by SAP and ensure that XML documents are only accepted from trusted sources.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/tags
- vendor/sap
- canonical/sap netweaver
- version/sap netweaver/7.30
- version/sap netweaver/7.31
- version/sap netweaver/7.40
- version/sap netweaver/7.41
- version/sap netweaver/7.50