CVE-2018-17861: SAP j2ee Engine

Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days.

A cross-site scripting (XSS) vulnerability in SAP J2EE Engine/7.01/Portal/EPP allows remote attackers to inject arbitrary web script via the wsdlLib parameter to /ctcprotocol/Protocol. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Affected products

• SAP j2ee Engine: version 7.01 only

Published 2021-08-09. Last modified 2026-06-17.