CVE-2018-17865

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A cross-site scripting (XSS) vulnerability in SAP J2EE Engine 7.01 allows remote attackers to inject arbitrary web script via the wsdlPath parameter to /ctcprotocol/Protocol. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-178666.1Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membershi CVE-2018-178677.2The Port Forwarding functionality on DASAN H660GW devices allows remote attackers to execute arbitrary code via shell metacharacters in the CVE-2018-178684.8DASAN H660GW devices have Stored XSS in the Port Forwarding functionality.CVE-2018-178698.8DASAN H660GW devices do not implement any CSRF protection mechanism.CVE-2018-17875.5IBM Spectrum Protect 7.1 and 8.1 is affected by a password exposure vulnerability caused by insecure file permissions. IBM X-Force ID: 14887 CVE-2018-178706.1An issue was discovered in BTITeam XBTIT 2.5.4. The "returnto" parameter of account_change.php is vulnerable to an open redirect, a differen CVE-2018-178716.5Verba Collaboration Compliance and Quality Management Platform before 9.2.1.5545 has Incorrect Access Control.CVE-2018-178728.8Verba Collaboration Compliance and Quality Management Platform before 9.2.1.5545 has Insecure Permissions.CVE-2018-178738.8An incorrect access control vulnerability in the FTP configuration of WiFiRanger devices with firmware version 7.0.8rc3 and earlier allows a CVE-2018-178746.1ExpressionEngine before 4.3.5 has reflected XSS.CVE-2018-178758.8A remote code execution issue in the ping command on Poly Trio 8800 5.7.1.4145 devices allows remote authenticated users to execute commands CVE-2018-178766.1A Stored XSS vulnerability has been discovered in the v5.5.0 version of the Coaster CMS product.