medium6.1
CVE-2018-2504
SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross…
Impact
SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting (XSS) vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sap | Netweaver Application Server Java | Versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/106150
- https://launchpad.support.sap.com/#/notes/2718993
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699
- http://www.securityfocus.com/bid/106150
- https://launchpad.support.sap.com/#/notes/2718993
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699