What is CVE-2018-2415?

CVE-2018-2415 is a medium-severity vulnerability in Sap J2ee_engine_server_core, classified under CWE-172. CVSS score: 4.7/10. Published 2018-05-09.

How severe is CVE-2018-2415?

Medium severity. CVSS v3 base score is 4.7 out of 10.

Vulnerability in Sap J2ee_engine_server_core

CVE-2018-2415

SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30, 7.31, 7.40, 7.50) do not sufficiently encode user controlled inputs, resulting…

EPSS: 0.012 (63.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N.

Affected products

Sap J2ee_engine_server_core — versions 7.11, 7.30, 7.31
Sap Netweaver_java_web_container_and_http_service_engine — versions 7.10, 7.11, 7.30
Sap Se Netweaver Application Server (Engine Api) — versions from 7.10 to 7.11, 7.30, 7.31
Sap Se Netweaver Application Server (J2ee Engine Core) — versions 7.11, 7.30, 7.31

Weakness classification (CWE)

CWE-172

References

cna@sap.com (x_refsource_CONFIRM, Vendor Advisory)
cna@sap.com (Permissions Required, x_refsource_MISC)
cna@sap.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)

Frequently asked questions

What is CVE-2018-2415?: CVE-2018-2415 is a medium-severity vulnerability in Sap J2ee_engine_server_core, classified under CWE-172. CVSS score: 4.7/10. Published 2018-05-09.
How severe is CVE-2018-2415?: Medium severity. CVSS v3 base score is 4.7 out of 10.