CVE-2018-2415

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30, 7.31, 7.40, 7.50) do not sufficiently encode user controlled inputs, resulting in a content spoofing vulnerability when error pages are displayed.

Metrics

CVSS 3.0 4.7/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-172

Affected software

Vendor	Product	Versions
SAP SE	SAP NetWeaver Application Server (Engine API)	from 7.10 to 7.11; 7.30; 7.31; 7.40; 7.50
SAP SE	SAP NetWeaver Application Server (J2EE Engine Server Core)	7.11; 7.30; 7.31; 7.40; 7.50

References

http://www.securityfocus.com/bid/104130Third Party Advisory, VDB Entry
https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2550202Permissions Required
http://www.securityfocus.com/bid/104130Third Party Advisory, VDB Entry
https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2550202Permissions Required

Timeline

Published: May 9, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-24165.4SAP Identity Management 7.2 and 8.0 do not sufficiently validate an XML document accepted from an untrusted source.CVE-2018-24175.3Under certain conditions, the SAP Identity Management 8.0 (pass of type ToASCII) allows an attacker to access information which would otherw CVE-2018-24189.8SAP MaxDB ODBC driver (all versions before 7.9.09.07) allows an attacker to inject code that can be executed by the application. An attacker CVE-2018-24194.6SAP Enterprise Financial Services (SAPSCORE 1.11, 1.12; S4CORE 1.01, 1.02; EA-FINSERV 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perf CVE-2018-24209.8SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to upload any file (including script files) without CVE-2018-24217.5SAP Internet Graphics Server (IGS) Portwatcher, 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to prevent legitimate users from accessi CVE-2018-24227.5SAP Internet Graphics Server (IGS) Portwatcher, 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to prevent legitimate users from accessi CVE-2018-24237.5SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, HTTP and RFC listener allows an attacker to prevent legitimate users fr CVE-2018-24247.5SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being ad CVE-2018-24255.5Under certain conditions, SAP Business One, 9.2, 9.3, for SAP HANA backup service allows an attacker to access information which would other CVE-2018-24278.8SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports (version for Visual Studio .NET, Version 20 CVE-2018-24285.3Under certain conditions SAP UI5 Handler allows an attacker to access information which would otherwise be restricted. Software components a