PT-2019-4256 · Sap · Sap Netweaver Process Integration

Published 2019-04-10 · Updated 2020-08-24 · CVE-2019-0283

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:P/I:C/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Process Integration (Adapter Engine) versions prior to 7.10 SAP NetWeaver Process Integration (Adapter Engine) versions 7.10 to 7.11 SAP NetWeaver Process Integration (Adapter Engine) version 7.30 SAP NetWeaver Process Integration (Adapter Engine) version 7.31 SAP NetWeaver Process Integration (Adapter Engine) version 7.40 SAP NetWeaver Process Integration (Adapter Engine) version 7.50

Description The issue is related to Digital Signature Spoofing, allowing an attacker to spoof XML signatures and send arbitrary requests to the server via the PI Axis adapter. These requests will be accepted by the PI Axis adapter even if the payload has been altered, especially when the signed element is the body of the XML document. The vulnerability is also associated with inadequate access control, which can be exploited by a remote attacker to send arbitrary requests to the server through the PI Axis adapter.

Recommendations For SAP NetWeaver Process Integration (Adapter Engine) versions prior to 7.10, update to version 7.10 or later. For SAP NetWeaver Process Integration (Adapter Engine) versions 7.10 to 7.11, update to version 7.30 or later. For SAP NetWeaver Process Integration (Adapter Engine) version 7.30, update to version 7.31 or later. For SAP NetWeaver Process Integration (Adapter Engine) version 7.31, update to version 7.40 or later. For SAP NetWeaver Process Integration (Adapter Engine) version 7.40, update to version 7.50 or later. For SAP NetWeaver Process Integration (Adapter Engine) version 7.50, no specific fix is provided, consider restricting access to the PI Axis adapter to minimize the risk of exploitation.

Fix

Improper Access Control

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-284

CWE-290

Related Identifiers

BDU:2019-04857

CVE-2019-0283

Affected Products

Sap Netweaver Process Integration

References · 5

• https://osv.dev/vulnerability/CVE-2019-0283 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0283 · Security Note
• https://bdu.fstec.ru/vul/2019-04857 · Security Note
• https://launchpad.support.sap.com/#/notes/2747683 · Vendor Advisory