CVE-2018-2415

SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30, 7.31, 7.40, 7.50) do not sufficiently encode user controlled inputs, resulting in a content spoofing vulnerability when error pages are displayed.

• CWE-172

• http://www.securityfocus.com/bid/104130Third Party Advisory, VDB Entry
• https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2550202Permissions Required
• http://www.securityfocus.com/bid/104130Third Party Advisory, VDB Entry
• https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2550202Permissions Required

Published

May 9, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-2406Unquoted windows search path (directory/path traversal) vuln…5.3
• CVE-2018-2408Improper Session Management in SAP Business Objects, 4.0, fr…7.3
• CVE-2018-2409Improper session management when using SAP Cloud Platform 2.…6.3
• CVE-2018-2410SAP Business One, 9.2, 9.3, browser access does not sufficie…5.4
• CVE-2018-2412SAP Disclosure Management 10.1 does not perform necessary au…3.8
• CVE-2018-2413SAP Disclosure Management 10.1 does not perform necessary au…5.4
• CVE-2018-2416SAP Identity Management 7.2 and 8.0 do not sufficiently vali…
• CVE-2018-2417Under certain conditions, the SAP Identity Management 8.0 (p…5.3
• CVE-2018-2418SAP MaxDB ODBC driver (all versions before 7.9.09.07) allows…5.5
• CVE-2018-2419SAP Enterprise Financial Services (SAPSCORE 1.11, 1.12; S4CO…3.7
• CVE-2018-2420SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.4…6.5
• CVE-2018-2421SAP Internet Graphics Server (IGS) Portwatcher, 7.20, 7.20EX…5.3