PT-2019-11228 · Sap · Sap Netweaver Process Integration

Published 2019-06-12 · Updated 2020-08-24 · CVE-2019-0312

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Process Integration versions 7.10 through 7.11, 7.20, 7.30, 7.31, 7.40, 7.50

Description: The issue allows an attacker to access landscape information, including host names and ports, due to the lack of password protection on several web pages. This could be particularly problematic in the absence of restrictive firewall and port settings.

Recommendations: For SAP NetWeaver Process Integration versions 7.10 through 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, consider implementing password protection for the affected web pages and ensure restrictive firewall and port settings are in place to minimize the risk of exploitation.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2019-0312

Affected Products

Sap Netweaver Process Integration

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-0312 · Security Note
• https://launchpad.support.sap.com/#/notes/2744086 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-0312 · Vendor Advisory