PT-2019-4330 · Sap · Sap Netweaver Process Integration

Published 2019-10-08 · Updated 2019-10-10 · CVE-2019-0367

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Process Integration (B2B Toolkit) versions prior to 1.0 and 2.0

Description The issue is related to missing authorization checks for authenticated users, allowing the import of B2B table content. This can lead to a Missing Authorization Check. The vulnerability is associated with authorization errors in SAP NetWeaver Process Integration, which can be exploited by a remote attacker to elevate their privileges.

Recommendations For versions prior to 1.0 and 2.0, consider implementing additional authorization checks to prevent the import of unauthorized B2B table content until a patch is available. As a temporary workaround, restrict access to sensitive B2B table content to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2020-00045

CVE-2019-0367

Affected Products

Sap Netweaver Process Integration

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-0367 · Security Note
• https://osv.dev/vulnerability/CVE-2019-0367 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00045 · Security Note
• https://launchpad.support.sap.com/#/notes/2805777 · Note