CVE-2018-17865 A cross-site scripting (XSS) vulnerability in SAP J2EE Engine 7.01 allows remote attackers to inject arbitrary web script via the wsdlPath parameter to /ctcprotocol/Protocol. NOTE: This vulnerability....
MediumCVSS 6.1
EPSS 0.75%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A cross-site scripting (XSS) vulnerability in SAP J2EE Engine 7.01 allows remote attackers to inject arbitrary web script via the wsdlPath parameter to /ctcprotocol/Protocol. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sap j2ee engine | = 7.01 | No fix listed |
References
- seclists.org mailing-list third-party-advisory