Vulnerability Details CVE-2018-2464
SAP WebDynpro Java, versions 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 62.3%
CVSS Severity
CVSS v3 Score 6.1
CVSS v2 Score 4.3
References
- http://www.securityfocus.com/bid/105308
- https://launchpad.support.sap.com/#/notes/2679378
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993
- http://www.securityfocus.com/bid/105308
- https://launchpad.support.sap.com/#/notes/2679378
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993
Products affected by CVE-2018-2464
-
cpe:2.3:a:sap:netweaver:7.20
-
cpe:2.3:a:sap:netweaver:7.30
-
cpe:2.3:a:sap:netweaver:7.31
-
cpe:2.3:a:sap:netweaver:7.40
-
cpe:2.3:a:sap:netweaver:7.50