CVE-2018-2492: XEE
SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted source. This is fixed in versions 7.2, 7.30, 7.31, 7.40 and 7.50.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-2492?
CVE-2018-2492 is a vulnerability in the SAML 2.0 functionality in SAP NetWeaver AS Java that allows an attacker to exploit insufficient validation of XML documents received from an untrusted source.
What is the severity of CVE-2018-2492?
The severity of CVE-2018-2492 is high, with a CVSS score of 7.1.
Which versions of SAP NetWeaver AS Java are affected by CVE-2018-2492?
Versions 7.20, 7.30, 7.31, 7.40, and 7.50 of SAP NetWeaver AS Java are affected by CVE-2018-2492.
How can I fix CVE-2018-2492?
The vulnerability is fixed in versions 7.2, 7.30, 7.31, 7.40, and 7.50 of SAP NetWeaver AS Java, so updating to one of these versions will resolve the issue.
Where can I find more information about CVE-2018-2492?
You can find more information about CVE-2018-2492 at the following references: [1] http://www.securityfocus.com/bid/106153 [2] https://launchpad.support.sap.com/#/notes/2642680 [3] https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699