CVE-2018-2504: XSS
SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting (XSS) vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-2504?
CVE-2018-2504 is a vulnerability in SAP NetWeaver AS Java Web Container service that allows for HTTP Host Header Manipulation or Cross-Site Scripting (XSS) attacks.
How severe is CVE-2018-2504?
CVE-2018-2504 has a severity rating of 6.1, which is considered medium.
Which versions of SAP NetWeaver AS Java Web Container are affected by CVE-2018-2504?
CVE-2018-2504 affects versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 of SAP NetWeaver AS Java Web Container.
How can I fix CVE-2018-2504?
To fix CVE-2018-2504, upgrade to versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, or 7.50 of SAP NetWeaver AS Java Web Container.
Where can I find more information about CVE-2018-2504?
You can find more information about CVE-2018-2504 at the following references: [http://www.securityfocus.com/bid/106150](http://www.securityfocus.com/bid/106150), [https://launchpad.support.sap.com/#/notes/2718993](https://launchpad.support.sap.com/#/notes/2718993), [https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699](https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699).