PT-2019-4303 · Sap · Sap Customer Relationship Management

Published 2019-10-08 · Updated 2019-10-17 · CVE-2019-0368

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP Customer Relationship Management versions prior to 1.0 and 2.0 SAP Customer Relationship Management (Email Management) versions prior to 7.0, excluding 7.0, 7.01, 7.02, 7.12, 7.13, and 7.14

Description The issue is related to the lack of input data sanitization, which can allow a remote attacker to perform cross-site scripting attacks. This can be exploited by an attacker to execute malicious scripts on the victim's system.

Recommendations For SAP Customer Relationship Management versions prior to 1.0 and 2.0, update to a version that includes proper input sanitization to prevent cross-site scripting attacks. For SAP Customer Relationship Management (Email Management) versions prior to 7.0, excluding 7.0, 7.01, 7.02, 7.12, 7.13, and 7.14, consider restricting access to the mail client until a patch is available that properly encodes user-controlled inputs.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-00018

CVE-2019-0368

Affected Products

Sap Customer Relationship Management

References · 5

• https://osv.dev/vulnerability/CVE-2019-0368 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0368 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00018 · Security Note
• https://launchpad.support.sap.com/#/notes/2751806 · Note