PT-2019-4328 · Sap · Sap Financial Consolidation

Published 2019-10-08 · Updated 2019-10-11 · CVE-2019-0370

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Financial Consolidation versions prior to 10.0 SAP Financial Consolidation version 10.1

Description The issue is related to errors in processing XML requests in the SAP Financial Consolidation web application. It allows a remote attacker to conduct an XPath injection attack due to missing input validation. This enables the attacker to interfere with the structure of the surrounding query using crafted input.

Recommendations For SAP Financial Consolidation versions prior to 10.0, update to version 10.0 or later to resolve the issue. For SAP Financial Consolidation version 10.1, update to a version later than 10.1 to resolve the issue. As a temporary workaround, consider restricting input validation to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-91

Related Identifiers

BDU:2020-00043

CVE-2019-0370

Affected Products

Sap Financial Consolidation

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-0370 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00043 · Security Note
• https://osv.dev/vulnerability/CVE-2019-0370 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2806403 · Note