CVE-2018-2492 SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted source. This is fixed in versions 7.2, 7.30, 7.31, 7.40 and 7.50.
HighCVSS 7.1
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted source. This is fixed in versions 7.2, 7.30, 7.31, 7.40 and 7.50.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sap netweaver application server java | = 7.20 | No fix listed |
| sap netweaver application server java | = 7.30 | No fix listed |
| sap netweaver application server java | = 7.31 | No fix listed |
| sap netweaver application server java | = 7.40 | No fix listed |
| sap netweaver application server java | = 7.50 | No fix listed |
| SAP NetWeaver Application Server (Java Library) | = = 7.20 | No fix listed |
| SAP NetWeaver Application Server (Java Library) | = = 7.30 | No fix listed |
| SAP NetWeaver Application Server (Java Library) | = = 7.31 | No fix listed |
| SAP NetWeaver Application Server (Java Library) | = = 7.50 | No fix listed |
References
- 106153 third-party-advisory vdb-entry
- launchpad.support.sap.com permissions-required
- wiki.scn.sap.com vendor-advisory