CVSS 3.0
4.7 mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:NCVE-2018-2415
SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30, 7.31, 7.40, 7.50) do not sufficiently encode user controlled inputs, resulting in a content spoofing vulnerability when error pages are displayed.
Severity
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
- CWE
- CWE-172
- Published
- Modified
- Record from
- the NVD, synced
Affected
- sap:j2ee_engine_server_core
- sap:netweaver_java_web_container_and_http_service_engine