PT-2018-15542 · Sap · J2Ee Engine Server Core+1

Publicado 2018-05-09 · Atualizado 2019-10-09 · CVE-2018-2415

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java Web Container and HTTP Service versions 7.10 through 7.11, 7.30, 7.31, 7.40, 7.50 J2EE Engine Server Core versions 7.11, 7.30, 7.31, 7.40, 7.50

Description The issue arises from insufficient encoding of user-controlled inputs, leading to a content spoofing issue when error pages are displayed.

Recommendations For SAP NetWeaver Application Server Java Web Container and HTTP Service versions 7.10 through 7.11, 7.30, 7.31, 7.40, 7.50, consider implementing proper input encoding to prevent content spoofing. For J2EE Engine Server Core versions 7.11, 7.30, 7.31, 7.40, 7.50, ensure that user-controlled inputs are sufficiently encoded to mitigate the risk of content spoofing. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-172

Identificadores relacionados

CVE-2018-2415

Produtos afetados

J2Ee Engine Server Core

Sap Netweaver Application Server Java Web Container/Http Service

Referências · 5

• https://osv.dev/vulnerability/CVE-2018-2415 · Aviso do Fabricante
• http://securityfocus.com/bid/104130 · Nota
• https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018 · Aviso do Fabricante
• https://launchpad.support.sap.com/#/notes/2550202 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-2415 · Nota de Segurança