VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Jun 12, 2018· Updated Jun 17, 2026

CVE-2018-2424

CVE-2018-2424

Description

SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to the DOM that could steal user information. Software components affected are: SAP Hana Database 1.00, 2.00; SAP UI5 1.00; SAP UI5 (Java) 7.30, 7.31, 7.40, 7,50; SAP UI 7.40, 7.50, 7.51, 7.52, and version 2.0 of SAP UI for SAP NetWeaver 7.00

Affected products

8
  • SAP/UIllm-create
    Range: 7.40, 7.50, 7.51, 7.52
  • SAP/UI5llm-fuzzy
    Range: 1.00
  • SAP/Hana Databasellm-fuzzy
    Range: 1.00, 2.00
  • SAP SE/SAP HANA Databasev5
    Range: 1.0
  • SAP SE/SAP UIv5
    Range: 7.40
  • SAP SE/SAP UI5v5
    Range: 1.0
  • SAP SE/SAP UI5(Java)v5
    Range: 7.3
  • SAP SE/SAP UI for SAP NetWeaver 7.00v5
    Range: 2.0

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.