PT-2018-15542 · Sap · J2Ee Engine Server Core+1

Published 2018-05-09 · Updated 2019-10-09 · CVE-2018-2415

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java Web Container and HTTP Service versions 7.10 through 7.11, 7.30, 7.31, 7.40, 7.50 J2EE Engine Server Core versions 7.11, 7.30, 7.31, 7.40, 7.50

Description The issue arises from insufficient encoding of user-controlled inputs, leading to a content spoofing issue when error pages are displayed.

Recommendations For SAP NetWeaver Application Server Java Web Container and HTTP Service versions 7.10 through 7.11, 7.30, 7.31, 7.40, 7.50, consider implementing proper input encoding to prevent content spoofing. For J2EE Engine Server Core versions 7.11, 7.30, 7.31, 7.40, 7.50, ensure that user-controlled inputs are sufficiently encoded to mitigate the risk of content spoofing. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-172

Related Identifiers

CVE-2018-2415

Affected Products

J2Ee Engine Server Core

Sap Netweaver Application Server Java Web Container/Http Service

References · 5

• https://osv.dev/vulnerability/CVE-2018-2415 · Vendor Advisory
• https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2415 · Security Note
• http://securityfocus.com/bid/104130 · Note
• https://launchpad.support.sap.com/#/notes/2550202 · Note