CVE-2008-1846

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-04-16 · updated 2026-06-16
Weakness: CWE-79

Description

The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" (aka Editor Security or Secure Editing) parameter, which allows remote attackers to conduct cross-site scripting (XSS) attacks by entering feedback for a file.

Affected products

SAP_SE SAP NetWeaver: through 7.0

References

http://securityreason.com/securityalert/3812
http://www.aitsec.com/vulnerability-SAP-Netweaver-6.40-7.0-Cross-Site-Scripting.php
http://www.securityfocus.com/archive/1/490625/100/0/threaded
http://www.securityfocus.com/bid/28699
http://www.securitytracker.com/id?1019822
https://exchange.xforce.ibmcloud.com/vulnerabilities/41735
http://securityreason.com/securityalert/3812
http://www.aitsec.com/vulnerability-SAP-Netweaver-6.40-7.0-Cross-Site-Scripting.php
http://www.securityfocus.com/archive/1/490625/100/0/threaded
http://www.securityfocus.com/bid/28699
http://www.securitytracker.com/id?1019822
https://exchange.xforce.ibmcloud.com/vulnerabilities/41735

Get alerted when CVE-2008-1846 or the next vulnerability affects your stack