VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Sep 11, 2018· Updated Jun 17, 2026

CVE-2018-2464

CVE-2018-2464

Description

SAP WebDynpro Java, versions 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability.

Affected products

7
  • SAP/Netweaver5 versions
    cpe:2.3:a:sap:netweaver:7.20:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:sap:netweaver:7.20:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver:7.30:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver:7.31:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver:7.40:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver:7.50:*:*:*:*:*:*:*
  • SAP/WebDynpro Javallm-create
    Range: 7.20, 7.30, 7.31, 7.40, 7.50
  • SAP/SAP WebDynprov5
    Range: = 7.20

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.