CVE-2018-2371: SAP NetWeaver Java Web Application

Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days.

The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting (XSS) vulnerability.

Affected products

• SAP NetWeaver Java Web Application: version 7.50 only

Published 2018-02-14. Last modified 2026-06-17.