PT-2019-2030 · Sap · Sap Netweaver Application Server Java

Publicado 2019-02-12 · Atualizado 2021-09-09 · CVE-2019-0275

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:N/A:P

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Java Application Server versions 7.10 through 7.11 SAP NetWeaver Java Application Server version 7.20 SAP NetWeaver Java Application Server version 7.30 SAP NetWeaver Java Application Server version 7.31 SAP NetWeaver Java Application Server version 7.40 SAP NetWeaver Java Application Server version 7.50

Description The issue exists due to insufficient protection of the web page structure in the SAP NetWeaver Java Application Server. This can allow a remote attacker to inject arbitrary code into a loaded web page. The SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting (XSS) issue.

Recommendations For SAP NetWeaver Java Application Server version 7.10, update to a version that includes the necessary security fixes. For SAP NetWeaver Java Application Server version 7.11, update to a version that includes the necessary security fixes. For SAP NetWeaver Java Application Server version 7.20, update to a version that includes the necessary security fixes. For SAP NetWeaver Java Application Server version 7.30, update to a version that includes the necessary security fixes. For SAP NetWeaver Java Application Server version 7.31, update to a version that includes the necessary security fixes. For SAP NetWeaver Java Application Server version 7.40, update to a version that includes the necessary security fixes. For SAP NetWeaver Java Application Server version 7.50, update to a version that includes the necessary security fixes.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2019-01743

CVE-2019-0275

Produtos afetados

Sap Netweaver Application Server Java

Referências · 6

• https://osv.dev/vulnerability/CVE-2019-0275 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-01743 · Nota de Segurança
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-0275 · Nota de Segurança
• http://securityfocus.com/bid/107362 · Nota
• https://launchpad.support.sap.com/#/notes/2689925 · Aviso do Fabricante