CVE-2018-2492 Missing XML Validation in SAP NetWeaver AS Java, SAP security note 2642680

SAP Note 2642680

SAP security note 2642680, "[CVE-2018-2492] Missing XML Validation in SAP NetWeaver AS Java", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

SAML 2.0 functionality in SAP NetWeaver AS Java does not sufficiently validate XML documents received from an untrusted source.

Retrieval of arbitrary files from the server
Denial-of-service conditions in successful exploits

Solution

Apply the corrective measures according to the Validity and SP Patch Level sections of this note.

CVSS

Score 7.1 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

References

Central note for SAP NetWeaver 7.31 SP24 Application Server Java

Full note on SAP: SAP Support Launchpad note 2642680

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#XXE #XML input parsing #SAP NetWeaver AS Java #SAML 2.0

Explore More

SAP Note 3765948: Code Injection via SSRF in SAP MII (CVE-2026-44772)

August 11, 2026

CVE-2026-44772, CVSS 9.9: XSL transform parameters let an authenticated user make SAP MII fetch and execute a remote stylesheet. The gate ships disabled.

SAP Note 3758900: Code Injection in SAP MII (CVE-2026-44758)

August 11, 2026

CVE-2026-44758, CVSS 9.1: the SAP MII IllumXSLTServlet compiled a caller supplied stylesheet. SAP removed the endpoint rather than patching it.

SAP Note 3759854: Directory Traversal in SAP MII (CVE-2026-44763)

August 11, 2026

CVE-2026-44763, CVSS 7.6: a save path in the SAP MII SSCE interface was assembled without containment, letting files land outside the intended folder.

SAP Note 3758657: Scheduling Authorization Gap, SAP MII (CVE-2026-44765)

August 11, 2026

CVE-2026-44765, CVSS 7.3: SAP MII scheduling functions were reachable without an authorization check. The fix adds guards and new role assignments.