PT-2019-4406 · Sap · S4Core+1
Publicado
2019-11-12
·
Atualizado
2019-11-15
·
CVE-2019-0393
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
SAP Quality Management versions prior to the corrected version in S4CORE 1.0, 1.01, 1.02, 1.03
Description
The issue exists due to the lack of measures to neutralize special elements used in SQL queries, allowing an attacker to exploit it and potentially disclose protected information by sending a specially crafted SQL query. This can enable an attacker to carry out targeted database queries that can read individual fields of historical inspection results.
Recommendations
For SAP Quality Management versions prior to the corrected version in S4CORE 1.0, 1.01, 1.02, 1.03, update to the corrected version to resolve the issue.
As a temporary workaround, consider restricting access to SQL queries to minimize the risk of exploitation.
Correção
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
S4Core
Sap Quality Management