PT-2019-4330 · Sap · Sap Netweaver Process Integration
Publicado
2019-10-08
·
Atualizado
2019-10-10
·
CVE-2019-0367
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
SAP NetWeaver Process Integration (B2B Toolkit) versions prior to 1.0 and 2.0
Description
The issue is related to missing authorization checks for authenticated users, allowing the import of B2B table content. This can lead to a Missing Authorization Check. The vulnerability is associated with authorization errors in SAP NetWeaver Process Integration, which can be exploited by a remote attacker to elevate their privileges.
Recommendations
For versions prior to 1.0 and 2.0, consider implementing additional authorization checks to prevent the import of unauthorized B2B table content until a patch is available.
As a temporary workaround, restrict access to sensitive B2B table content to minimize the risk of exploitation.
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Sap Netweaver Process Integration