CVE-2018-2464: XSS

Published Sep 11, 2018

Updated

SAP WebDynpro Java, versions 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability.

Affected Software

5 affected components

SAP NetWeaver=7.20

SAP NetWeaver=7.30

SAP NetWeaver=7.31

SAP NetWeaver=7.40

SAP NetWeaver=7.50

Event History

Sep 11, 2018

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2018-2464?

CVE-2018-2464 is a Cross-Site Scripting (XSS) vulnerability found in SAP WebDynpro Java versions 7.20, 7.30, 7.31, 7.40, and 7.50.

How severe is CVE-2018-2464?

CVE-2018-2464 has a severity rating of 6.1, which is considered medium.

Which software versions are affected by CVE-2018-2464?

SAP WebDynpro Java versions 7.20, 7.30, 7.31, 7.40, and 7.50 are affected by CVE-2018-2464.

How can I fix CVE-2018-2464?

To fix CVE-2018-2464, apply the necessary patches provided by SAP or upgrade to a version that is not affected.

Where can I find more information about CVE-2018-2464?

You can find more information about CVE-2018-2464 on the following references: [1] http://www.securityfocus.com/bid/105308 [2] https://launchpad.support.sap.com/#/notes/2679378 [3] https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993