PT-2019-2030 · Sap · Sap Netweaver Application Server Java

Published 2019-02-12 · Updated 2021-09-09 · CVE-2019-0275

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:P

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Java Application Server versions 7.10 through 7.11 SAP NetWeaver Java Application Server version 7.20 SAP NetWeaver Java Application Server version 7.30 SAP NetWeaver Java Application Server version 7.31 SAP NetWeaver Java Application Server version 7.40 SAP NetWeaver Java Application Server version 7.50

Description The issue exists due to insufficient protection of the web page structure in the SAP NetWeaver Java Application Server. This can allow a remote attacker to inject arbitrary code into a loaded web page. The SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting (XSS) issue.

Recommendations For SAP NetWeaver Java Application Server version 7.10, update to a version that includes the necessary security fixes. For SAP NetWeaver Java Application Server version 7.11, update to a version that includes the necessary security fixes. For SAP NetWeaver Java Application Server version 7.20, update to a version that includes the necessary security fixes. For SAP NetWeaver Java Application Server version 7.30, update to a version that includes the necessary security fixes. For SAP NetWeaver Java Application Server version 7.31, update to a version that includes the necessary security fixes. For SAP NetWeaver Java Application Server version 7.40, update to a version that includes the necessary security fixes. For SAP NetWeaver Java Application Server version 7.50, update to a version that includes the necessary security fixes.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2019-01743

CVE-2019-0275

Affected Products

Sap Netweaver Application Server Java

References · 6

• https://osv.dev/vulnerability/CVE-2019-0275 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01743 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0275 · Security Note
• https://launchpad.support.sap.com/#/notes/2689925 · Vendor Advisory
• http://securityfocus.com/bid/107362 · Note