CVE-2018-2364
UnknownEPSS 0.98%
Last modified
CVE-2018-2364 is a vulnerability of currently unknown severity. SAP CRM WebClient UI 7.01, 7.31, 7.46, 7.47, 7.48, 8.00, 8.01, S4FND 1.02, does not sufficiently validate and/or encode hidden fields, resulting in Cross-Site Scripting (XSS) vulnerability.. EPSS estimates a 0.98% chance of exploitation in the next 30 days.
Description
SAP CRM WebClient UI 7.01, 7.31, 7.46, 7.47, 7.48, 8.00, 8.01, S4FND 1.02, does not sufficiently validate and/or encode hidden fields, resulting in Cross-Site Scripting (XSS) vulnerability.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sap | Customer Relationship Management Webclient Ui | 7.01 |
| Sap | Customer Relationship Management Webclient Ui | 7.31 |
| Sap | Customer Relationship Management Webclient Ui | 7.46 |
| Sap | Customer Relationship Management Webclient Ui | 7.47 |
| Sap | Customer Relationship Management Webclient Ui | 7.48 |
| Sap | Customer Relationship Management Webclient Ui | 8.00 |
| Sap | Customer Relationship Management Webclient Ui | 8.01 |
| Sap | S4fnd | 1.02 |
References
- http://www.securityfocus.com/bid/103002Third Party Advisory, VDB Entry
- https://launchpad.support.sap.com/#/notes/2541700Permissions Required
- http://www.securityfocus.com/bid/103002Third Party Advisory, VDB Entry
- https://launchpad.support.sap.com/#/notes/2541700Permissions Required
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-2364?
SAP CRM WebClient UI 7.01, 7.31, 7.46, 7.47, 7.48, 8.00, 8.01, S4FND 1.02, does not sufficiently validate and/or encode hidden fields, resulting in Cross-Site Scripting (XSS) vulnerability.
How severe is CVE-2018-2364?
Severity scoring for CVE-2018-2364 is pending analysis. The EPSS model estimates a 0.98% probability of exploitation in the next 30 days.
How do I fix CVE-2018-2364?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-2358Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2018-2359Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2018-2360SAP Startup Service, SAP KERNEL 7.45, 7.49, and 7.52, is mis…
- CVE-2018-2361In SAP Solution Manager 7.20, the role SAP_BPO_CONFIG gives …
- CVE-2018-2362A remote unauthenticated attacker, SAP HANA 1.00 and 2.00, c…
- CVE-2018-2363SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.1…
- CVE-2018-2365SAP NetWeaver Portal, WebDynpro Java, 7.30, 7.31, 7.40, 7.50…
- CVE-2018-2366SAP Business Process Automation (BPA) By Redwood, 9.0, 9.1, …4.3
- CVE-2018-2367ABAP File Interface in, SAP BASIS, from 7.00 to 7.02, from 7…
- CVE-2018-2368SAP NetWeaver System Landscape Directory, LM-CORE 7.10, 7.20…
- CVE-2018-2369Under certain conditions SAP HANA, 1.00, 2.00, allows an una…
- CVE-2018-2370Server Side Request Forgery (SSRF) vulnerability in SAP Cent…
Are you affected by CVE-2018-2364?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST