PT-2019-4406 · Sap · S4Core+1

Published 2019-11-12 · Updated 2019-11-15 · CVE-2019-0393

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Quality Management versions prior to the corrected version in S4CORE 1.0, 1.01, 1.02, 1.03

Description The issue exists due to the lack of measures to neutralize special elements used in SQL queries, allowing an attacker to exploit it and potentially disclose protected information by sending a specially crafted SQL query. This can enable an attacker to carry out targeted database queries that can read individual fields of historical inspection results.

Recommendations For SAP Quality Management versions prior to the corrected version in S4CORE 1.0, 1.01, 1.02, 1.03, update to the corrected version to resolve the issue. As a temporary workaround, consider restricting access to SQL queries to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2020-00128

CVE-2019-0393

Affected Products

S4Core

Sap Quality Management

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-0393 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-0393 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00128 · Security Note
• https://launchpad.support.sap.com/#/notes/2816035 · Vendor Advisory