CVE-2008-1846
The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure...
The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" (aka Editor Security or Secure Editing) parameter, which allows remote attackers to conduct cross-site scripting (XSS) attacks by entering feedback for a file.
Exploit likelihood
What each source reports
NVD Score used
The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" (aka Editor Security or Secure Editing) parameter, which allows remote attackers to conduct cross-site scripting (XSS) attacks by entering feedback for a file.
- Record
CVE-2008-1846- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" (aka Editor Security or Secure Editing) parameter, which allows remote attackers to conduct cross-site scripting (XSS) attacks by entering feedback for a file.
- Record
CVE-2008-1846- Updated
- 2026-11-02
EUVDEUVD-2008-1846 No score
The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" (aka Editor Security or Secure Editing) parameter, which allows remote attackers to conduct cross-site scripting (XSS) attacks by entering feedback for a file.
- Record
EUVD-2008-1846- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v2h7-hrfg-524r No score
The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure...
The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" (aka Editor Security or Secure Editing) parameter, which allows remote attackers to conduct cross-site scripting (XSS) attacks by entering feedback for a file.
- Record
GHSA-v2h7-hrfg-524r- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1846 is a medium vulnerability (CVSS 4.3) in Sap Netweaver, published April 16, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.22%, the 68th percentile. No source names a fixed version.
References
aitsec.com/vulnerability-SAP-Netweaver-6.40-7.0-Cross-Site-Scripting.php
securitytracker.com/id?1019822
securityfocus.com/bid/28699
securityreason.com/securityalert/3812
exchange.xforce.ibmcloud.com/vulnerabilities/41735
nvd.nist.gov/vuln/detail/CVE-2008-1846
github.com/advisories/GHSA-v2h7-hrfg-524r