CVE-2018-2371

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting (XSS) vulnerability.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 14, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-23726.5A plain keystore password is written to a system log file in SAP HANA Extended Application Services, 1.0, which could endanger confidentiali CVE-2018-23737.5Under certain circumstances, a specific endpoint of the Controller's API could be misused by unauthenticated users to execute SQL statements CVE-2018-23746.5In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve sens CVE-2018-23758.1In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve appl CVE-2018-23768.1In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve appl CVE-2018-23776.5In SAP HANA Extended Application Services, 1.0, some general server statistics and status information could be retrieved by unauthorized use CVE-2018-23786.5In SAP HANA Extended Application Services, 1.0, unauthorized users can read statistical data about deployed applications including resource CVE-2018-23796.5In SAP HANA Extended Application Services, 1.0, an unauthenticated user could test if a given username is valid by evaluating error messages CVE-2018-23806.6SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thu CVE-2018-23818.8SAP ERP Financials Information System (SAP_APPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAP_FIN 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE 1.00, CVE-2018-23826.5A vulnerability in the SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53, could allow a malicious user to store graphics in a co CVE-2018-23836.1Reflected cross-site scripting vulnerability in SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53.