PT-2019-11208 · Sap · Sap Crm Webclient Ui

Published 2019-01-08 · Updated 2019-01-17 · CVE-2019-0244

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: SAP CRM WebClient UI versions prior to 7.31, 7.46, 7.47, 7.48, 8.0, 8.01 SAP CRM WebClient UI versions prior to SAPSCORE 1.12 SAP CRM WebClient UI versions prior to S4FND 1.02 SAP CRM WebClient UI versions prior to WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01

Description: The issue is related to insufficient encoding of user-controlled inputs, resulting in a Cross-Site Scripting (XSS) issue.

Recommendations: For SAP CRM WebClient UI versions prior to SAPSCORE 1.12, update to SAPSCORE 1.12 or later. For SAP CRM WebClient UI versions prior to S4FND 1.02, update to S4FND 1.02 or later. For SAP CRM WebClient UI versions prior to WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01, update to WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-0244

Affected Products

Sap Crm Webclient Ui

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-0244 · Security Note
• https://launchpad.support.sap.com/#/notes/2588763 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-0244 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985 · Vendor Advisory
• http://securityfocus.com/bid/106473 · Note