CVE-2018-17862 A cross-site scripting (XSS) vulnerability in SAP J2EE Engine/7.01/Fiori allows remote attackers to inject arbitrary web script via the sys_jdbc parameter to /TestJDBC_Web/test2. NOTE: This vulnerabil...
MediumCVSS 6.1
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A cross-site scripting (XSS) vulnerability in SAP J2EE Engine/7.01/Fiori allows remote attackers to inject arbitrary web script via the sys_jdbc parameter to /TestJDBC_Web/test2. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sap j2ee engine | = 7.01 | No fix listed |
References
- packetstormsecurity.com third-party-advisory vdb-entry
- 20190305 SAP J2EE Engine/7.01/Fiori Reflected Cross Site Scripting (XSS) mailing-list third-party-advisory
- 20190304 SAP J2EE Engine/7.01/Fiori Reflected Cross Site Scripting (XSS) mailing-list third-party-advisory