CVE-2008-1846
Last modified
CVE-2008-1846 is a vulnerability of currently unknown severity. The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" (aka Editor Security or Secure Editing) parameter, which allows remote attackers to conduct cross-site scripting (XSS) attacks by entering feedback for a file.. EPSS estimates a 1.22% chance of exploitation in the next 30 days.
Description
The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" (aka Editor Security or Secure Editing) parameter, which allows remote attackers to conduct cross-site scripting (XSS) attacks by entering feedback for a file.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Sap | Netweaver | <= 7.0 | Sp8 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2008-1846?
How severe is CVE-2008-1846?
How do I fix CVE-2008-1846?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2008
- CVE-2008-1840SQL injection vulnerability in upload.php in Coppermine Phot…
- CVE-2008-1841SQL injection vulnerability in the session handling function…
- CVE-2008-1842Integer signedness error in ovspmd.exe in HP OpenView Networ…
- CVE-2008-1843SQL injection vulnerability in browse.php in W2B DatingClub …
- CVE-2008-1844SQL injection vulnerability in cat.php in W2B phpHotResource…
- CVE-2008-1845The Korn shell (aka mksh) before R33d on MirOS (aka MirBSD) …
- CVE-2008-1847SQL injection vulnerability in view.php in CoronaMatrix phpA…
- CVE-2008-1848Cross-site scripting (XSS) vulnerability in the joomlaXplore…
- CVE-2008-1849Directory traversal vulnerability in index.php in the joomla…
- CVE-2008-1850Multiple cross-site scripting (XSS) vulnerabilities in login…
- CVE-2008-1851ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.51…
- CVE-2008-1852ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.51…
Are you affected by CVE-2008-1846?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST