CVE-2018-2505

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

SAP Commerce does not sufficiently validate user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability in storefronts that are based on the product. Fixed in versions (SAP Hybris Commerce, versions 6.2, 6.3, 6.4, 6.5, 6.6, 6.7).

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
SAPSAP Commerce (SAP Hybris Commerce)6.2; 6.3; 6.4; 6.5; 6.6; 6.7

References

Timeline

Published
Dec 11, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-250506.1A vulnerability, which was classified as problematic, has been found in Harvest Chosen up to 1.8.6. Affected by this issue is the function ACVE-2018-250516.1A vulnerability, which was classified as problematic, was found in JmPotato Pomash. This affects an unknown part of the file Pomash/theme/clCVE-2018-250526.1A vulnerability has been found in Catalyst-Plugin-Session up to 0.40 and classified as problematic. This vulnerability affects the function CVE-2018-250536.1A vulnerability was found in moappi Json2html up to 1.1.x and classified as problematic. This issue affects some unknown processing of the fCVE-2018-250545.4A vulnerability was found in shred cilla. It has been classified as problematic. Affected is an unknown function of the file cilla-xample/srCVE-2018-250556.1A vulnerability was found in FarCry Solr Pro Plugin up to 1.5.x. It has been declared as problematic. Affected by this vulnerability is an uCVE-2018-250566.1A vulnerability, which was classified as problematic, was found in yolapi. Affected is the function render_description of the file yolapi/pyCVE-2018-250579.8A vulnerability was found in simple_php_link_shortener. It has been classified as critical. Affected is an unknown function of the file indeCVE-2018-250586.1A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file js/twiCVE-2018-250595.3A vulnerability was found in pastebinit up to 0.2.2 and classified as problematic. Affected by this issue is the function pasteHandler of thCVE-2018-250607.5A vulnerability was found in Macaron csrf and classified as problematic. Affected by this issue is some unknown functionality of the file csCVE-2018-250617.5A vulnerability was found in rgb2hex up to 0.1.5. It has been rated as problematic. This issue affects some unknown processing. The manipula