PT-2019-4583 · Sap · Sap Gateway

Rafael Fontes Souza · Publicado 2019-07-09 · Atualizado 2020-08-24 · CVE-2019-0319

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions SAP Gateway versions 7.5 through 7.53

Description The issue allows an attacker to inject content that is displayed as an error message, potentially misleading users into believing the information comes from a legitimate service. This is due to the lack of measures to neutralize special elements, which could allow a remote attacker to impact data integrity.

Recommendations For SAP Gateway versions 7.5 through 7.53, consider implementing measures to neutralize special elements and validate user input to prevent content injection. As a temporary workaround, restrict access to error messages that could be manipulated by an attacker.

Exploit

Correção

Special Elements Injection

XSS

Enumeração de Fraquezas

CWE-74

CWE-79

Identificadores relacionados

BDU:2020-00643

CVE-2019-0319

Produtos afetados

Sap Gateway

Referências · 10

• 🔥 http://packetstormsecurity.com/files/153661/SAPUI5-1.0.0-SAP-Gateway-7.5-7.51-7.52-7.53-Content-Spoofing.html · Exploit
• 🔥 https://drive.google.com/open?id=1aGFqggvydehSK7MFIsfKW7tO60yiF55f · Exploit
• https://bdu.fstec.ru/vul/2020-00643 · Nota de Segurança
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575 · Aviso do Fabricante
• https://launchpad.support.sap.com/#/notes/2911267 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-0319 · Nota de Segurança
• https://launchpad.support.sap.com/#/notes/2752614 · Aviso do Fabricante
• http://securityfocus.com/bid/109074 · Nota
• https://cxsecurity.com/ascii/WLB-2019050283 · Nota
• https://osv.dev/vulnerability/CVE-2019-0319 · Aviso do Fabricante