PT-2019-4586 · Sap · Sap Netweaver Application Server Java

Publicado 2019-07-09 · Atualizado 2019-07-18 · CVE-2019-0327

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SAP NetWeaver for Java Application Server - Web Container versions 7.1 through 7.5

Description The issue allows an attacker to upload files, including script files, without proper file format validation. This can be exploited by a remote attacker to upload malicious files.

Recommendations For versions 7.1 through 7.5, consider implementing proper file format validation to prevent the upload of malicious files. As a temporary workaround, restrict access to the file upload functionality until a proper fix is applied.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

BDU:2020-00646

CVE-2019-0327

Produtos afetados

Sap Netweaver Application Server Java

Referências · 6

• https://launchpad.support.sap.com/#/notes/2777910 · Aviso do Fabricante
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-0327 · Nota de Segurança
• https://bdu.fstec.ru/vul/2020-00646 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-0327 · Aviso do Fabricante
• http://securityfocus.com/bid/109071 · Nota