CVE-2018-17865: SAP j2ee Engine

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

A cross-site scripting (XSS) vulnerability in SAP J2EE Engine 7.01 allows remote attackers to inject arbitrary web script via the wsdlPath parameter to /ctcprotocol/Protocol. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Affected products

• SAP j2ee Engine: version 7.01 only

Published 2021-08-09. Last modified 2026-06-17.