CVE-2018-2399

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-Site Scripting in Process Monitoring Infrastructure, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to inefficient encoding of user controlled inputs.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SAP SE	SAP Process Monitoring Infrastructure	from 7.10 to 7.11; 7.20; 7.30; 7.31; 7.40; 7.50

References

http://www.securityfocus.com/bid/103372Third Party Advisory, VDB Entry
https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2592807Permissions Required, Vendor Advisory
http://www.securityfocus.com/bid/103372Third Party Advisory, VDB Entry
https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2592807Permissions Required, Vendor Advisory

Timeline

Published: Mar 14, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-24007.5Under certain conditions SAP Business Process Automation (BPA) By Redwood, 9.00, 9.10, allows an attacker to access information which would CVE-2018-24018.8SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting CVE-2018-24028.4In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about ca CVE-2018-24036.5Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access information which would otherwise be restricted. It is CVE-2018-24049.8SAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation.CVE-2018-24055.4SAP Solution Manager, 7.10, 7.20, Incident Management Work Center allows an attacker to upload a malicious script as an attachment and this CVE-2018-24065.3Unquoted windows search path (directory/path traversal) vulnerability in Crystal Reports Server, OEM Edition (CRSE), 4.0, 4.10, 4.20, 4.30, CVE-2018-24087.3Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of pa CVE-2018-24098.8Improper session management when using SAP Cloud Platform 2.0 (Connectivity Service and Cloud Connector). Under certain conditions, data of CVE-2018-24105.4SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross-Site Scripting (XSS CVE-2018-24128.8SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privile CVE-2018-24138.8SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privile