CVE-2018-2410

MEDIUM

SAP Business One 9.2, 9.3 - Cross-Site Scripting via Browser Access Input

Title source: llm

Description

SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross-Site Scripting (XSS) vulnerability.

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/103704

Vendor Advisory x_refsource_confirm

https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018/

Permissions Required, Vendor Advisory x_refsource_misc

https://launchpad.support.sap.com/#/notes/2582870

Scores

CVSS v3 5.4

EPSS 0.0028

EPSS Percentile 51.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (2)

sap/business_one 9.2

sap/business_one 9.3

Published Apr 10, 2018

Tracked Since Feb 18, 2026