CVE-2018-2371 The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting (XSS) vulnerability.
MediumCVSS 6.1
EPSS 0.96%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting (XSS) vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sap netweaver java web application | = 7.50 | No fix listed |
| SAP_SE SAP NetWeaver Java Web Application | = 7.50 | No fix listed |
References
- 103005 third-party-advisory vdb-entry
- blogs.sap.com vendor-advisory
- launchpad.support.sap.com permissions-required