Vulnerability Details : CVE-2018-2415
SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30, 7.31, 7.40, 7.50) do not sufficiently encode user controlled inputs, resulting in a content spoofing vulnerability when error pages are displayed.
Products affected by CVE-2018-2415
- cpe:2.3:a:sap:netweaver_java_web_container_and_http_service_engine:7.50:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_java_web_container_and_http_service_engine:7.10:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_java_web_container_and_http_service_engine:7.11:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_java_web_container_and_http_service_engine:7.30:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_java_web_container_and_http_service_engine:7.31:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_java_web_container_and_http_service_engine:7.40:*:*:*:*:*:*:*
- cpe:2.3:a:sap:j2ee_engine_server_core:7.30:*:*:*:*:*:*:*
- cpe:2.3:a:sap:j2ee_engine_server_core:7.31:*:*:*:*:*:*:*
- cpe:2.3:a:sap:j2ee_engine_server_core:7.40:*:*:*:*:*:*:*
- cpe:2.3:a:sap:j2ee_engine_server_core:7.50:*:*:*:*:*:*:*
- cpe:2.3:a:sap:j2ee_engine_server_core:7.11:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-2415
0.14%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 48 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-2415
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
|
4.7
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N |
2.8
|
1.4
|
SAP SE | |
|
4.7
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N |
2.8
|
1.4
|
NIST |
CWE ids for CVE-2018-2415
-
The product does not properly encode or decode the data, resulting in unexpected values.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-2415
-
https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/
SAP Security Patch Day – May 2018 | SAP BlogsVendor Advisory
-
https://launchpad.support.sap.com/#/notes/2550202
SAP ONE Support Launchpad: Log OnPermissions Required
-
http://www.securityfocus.com/bid/104130
SAP NetWeaver Java AS CVE-2018-2415 Unspecified Content Spoofing VulnerabilityThird Party Advisory;VDB Entry
Jump to