SAP j2ee Engine vulnerabilities

4 CVEs affecting SAP j2ee Engine, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-17865, published 2021-08-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-17861, published 2021-08-09. Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days. A cross-site scripting (XSS) vulnerability in SAP J2EE Engine/7.01/Portal/EPP allows remote attackers to inject arbitrary web script via the wsdlLib parameter to /ctcprotocol/Protocol. NOTE: This…
CVE-2018-17862, published 2021-08-09. Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days. A cross-site scripting (XSS) vulnerability in SAP J2EE Engine/7.01/Fiori allows remote attackers to inject arbitrary web script via the sys_jdbc parameter to /TestJDBC_Web/test2. NOTE: This…
CVE-2013-7357, published 2014-04-10. Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days. Unspecified vulnerability in the configuration service in SAP J2EE Engine allows remote attackers to obtain credential information via unknown vectors.
CVE-2018-17865, published 2021-08-09. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. A cross-site scripting (XSS) vulnerability in SAP J2EE Engine 7.01 allows remote attackers to inject arbitrary web script via the wsdlPath parameter to /ctcprotocol/Protocol. NOTE: This vulnerability…