PT-2019-4337 · Sap · Sap-Jeecor+1

Published

2019-09-10

·

Updated

2019-09-11

·

CVE-2019-0355

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java versions prior to 7.10 SAP NetWeaver Application Server Java versions prior to 7.20 SAP NetWeaver Application Server Java versions prior to 7.30 SAP NetWeaver Application Server Java versions prior to 7.31 SAP NetWeaver Application Server Java versions prior to 7.40 SAP NetWeaver Application Server Java versions prior to 7.50 SAP-JEECOR versions prior to 6.40 SAP-JEECOR versions prior to 7.0 SAP-JEECOR versions prior to 7.01
Description The issue is related to incorrect code generation management in the SAP NetWeaver Application Server Java. This can allow a remote attacker to execute arbitrary code, potentially controlling the application's behavior.
Recommendations For SAP NetWeaver Application Server Java versions prior to 7.10, update to version 7.10 or later. For SAP NetWeaver Application Server Java versions prior to 7.20, update to version 7.20 or later. For SAP NetWeaver Application Server Java versions prior to 7.30, update to version 7.30 or later. For SAP NetWeaver Application Server Java versions prior to 7.31, update to version 7.31 or later. For SAP NetWeaver Application Server Java versions prior to 7.40, update to version 7.40 or later. For SAP NetWeaver Application Server Java versions prior to 7.50, update to version 7.50 or later. For SAP-JEECOR versions prior to 6.40, update to version 6.40 or later. For SAP-JEECOR versions prior to 7.0, update to version 7.0 or later. For SAP-JEECOR versions prior to 7.01, update to version 7.01 or later.

Fix

Code Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2020-00054
CVE-2019-0355

Affected Products

Sap Netweaver Application Server Java
Sap-Jeecor