PT-2019-4328 · Sap · Sap Financial Consolidation

Publicado 2019-10-08 · Atualizado 2019-10-11 · CVE-2019-0370

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Financial Consolidation versions prior to 10.0 SAP Financial Consolidation version 10.1

Description The issue is related to errors in processing XML requests in the SAP Financial Consolidation web application. It allows a remote attacker to conduct an XPath injection attack due to missing input validation. This enables the attacker to interfere with the structure of the surrounding query using crafted input.

Recommendations For SAP Financial Consolidation versions prior to 10.0, update to version 10.0 or later to resolve the issue. For SAP Financial Consolidation version 10.1, update to a version later than 10.1 to resolve the issue. As a temporary workaround, consider restricting input validation to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-91

Identificadores relacionados

BDU:2020-00043

CVE-2019-0370

Produtos afetados

Sap Financial Consolidation

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-0370 · Nota de Segurança
• https://launchpad.support.sap.com/#/notes/2806403 · Nota
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2020-00043 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-0370 · Aviso do Fabricante