PT-2019-4404 · Sap · Sap Netweaver As Java

Published 2019-11-12 · Updated 2020-08-24 · CVE-2019-0391

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS Java versions prior to 7.10 SAP NetWeaver AS Java versions prior to 7.20 SAP NetWeaver AS Java versions prior to 7.30 SAP NetWeaver AS Java versions prior to 7.31 SAP NetWeaver AS Java versions prior to 7.40 SAP NetWeaver AS Java versions prior to 7.50

Description The issue allows an attacker to access restricted information under certain conditions due to a lack of protection for service data. This can enable a remote attacker to gain unauthorized access to protected information.

Recommendations For versions prior to 7.10, update to version 7.10 or later. For versions prior to 7.20, update to version 7.20 or later. For versions prior to 7.30, update to version 7.30 or later. For versions prior to 7.31, update to version 7.31 or later. For versions prior to 7.40, update to version 7.40 or later. For versions prior to 7.50, update to version 7.50 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2020-00126

CVE-2019-0391

Affected Products

Sap Netweaver As Java

References · 5

• https://bdu.fstec.ru/vul/2020-00126 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-0391 · Security Note
• https://osv.dev/vulnerability/CVE-2019-0391 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2835226 · Vendor Advisory