SAP Netweaver AS Java (Servercore) vulnerabilities

2 vulnerabilities

Known vulnerabilities in SAP Netweaver AS Java (Servercore), newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.1CVE-2018-2504sapnetweaver_application_server_java+1
EPSS score
1.06%
SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting (XSS) vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50.7.4CVE-2018-2503sapnetweaver_application_server_java+1
EPSS score
0.57%
By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected. This has been fixed in SAP NetWeaver AS Java (ServerCore versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50).