CVE-2018-2492

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted source. This is fixed in versions 7.2, 7.30, 7.31, 7.40 and 7.50.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published
Dec 11, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-24948.0Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP Basis AS ABAP of SAPCVE-2018-24972.7The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntaxCVE-2018-24997.5A security weakness in SAP Financial Consolidation Cube Designer (BOBJ_EADES fixed in versions 8.0, 10.1) may allow an attacker to discover CVE-2018-25004.7Under certain conditions SAP Mobile Secure Android client (before version 6.60.19942.0 SP28 1711) allows an attacker to access information wCVE-2018-250016.5An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust. proplist::Iterator can cause a use-after-free.CVE-2018-250028.8uploader.php in the KCFinder integration project through 2018-06-01 for Drupal mishandles validation, aka SA-CONTRIB-2018-024. NOTE: This prCVE-2018-250044.9A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find querCVE-2018-250074.3Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 throuCVE-2018-250085.9In the standard library in Rust before 1.29.0, there is weak synchronization in the Arc::get_mut method. This synchronization issue can be lCVE-2018-250099.1A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16().CVE-2018-250109.1A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter().CVE-2018-250119.8A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in PutLE16().