CVE-2018-2364: SAP Customer Relationship Management Webclient UI

Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days.

SAP CRM WebClient UI 7.01, 7.31, 7.46, 7.47, 7.48, 8.00, 8.01, S4FND 1.02, does not sufficiently validate and/or encode hidden fields, resulting in Cross-Site Scripting (XSS) vulnerability.

Affected products

• SAP Customer Relationship Management Webclient UI: version 7.01 only; version 7.31 only; version 7.46 only; version 7.47 only; version 7.48 only; version 8.00 only; …
• SAP s4fnd: version 1.02 only

Published 2018-02-14. Last modified 2026-06-17.