CVE-2018-2504
Last modified
CVE-2018-2504 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting (XSS) vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50.. EPSS estimates a 1.06% chance of exploitation in the next 30 days.
Description
SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting (XSS) vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sap | Netweaver Application Server Java | 7.10 |
| Sap | Netweaver Application Server Java | 7.11 |
| Sap | Netweaver Application Server Java | 7.20 |
| Sap | Netweaver Application Server Java | 7.30 |
| Sap | Netweaver Application Server Java | 7.31 |
| Sap | Netweaver Application Server Java | 7.40 |
| Sap | Netweaver Application Server Java | 7.50 |
References
- http://www.securityfocus.com/bid/106150Third Party Advisory, VDB Entry
- https://launchpad.support.sap.com/#/notes/2718993Permissions Required
- http://www.securityfocus.com/bid/106150Third Party Advisory, VDB Entry
- https://launchpad.support.sap.com/#/notes/2718993Permissions Required
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-2504?
How severe is CVE-2018-2504?
How do I fix CVE-2018-2504?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-25034A vulnerability, which was classified as problematic, has be…5.4
- CVE-2018-25035A vulnerability, which was classified as problematic, was fo…5.4
- CVE-2018-25036A vulnerability has been found in Thomson TCW710 ST5D.10.05 …5.4
- CVE-2018-25037A vulnerability was found in Thomson TCW710 ST5D.10.05 and c…5.4
- CVE-2018-25038A vulnerability was found in Thomson TCW710 ST5D.10.05. It h…5.4
- CVE-2018-25039A vulnerability was found in Thomson TCW710 ST5D.10.05. It h…5.4
- CVE-2018-25040A vulnerability was found in uTorrent Web. It has been decla…8.8
- CVE-2018-25041A vulnerability was found in uTorrent. It has been rated as …8.8
- CVE-2018-25042A vulnerability classified as critical has been found in uTo…8.8
- CVE-2018-25043A vulnerability classified as critical was found in uTorrent…8.8
- CVE-2018-25044A vulnerability, which was classified as critical, has been …8.8
- CVE-2018-25045Django REST framework (aka django-rest-framework) before 3.9…6.1
Are you affected by CVE-2018-2504?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST