PT-2019-4578 · Sap · Sap Netweaver Process Integration

Published 2019-06-14 · Updated 2020-02-10 · CVE-2019-0316

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Process Integration versions 7.10 through 7.11 SAP NetWeaver Process Integration version 7.20 SAP NetWeaver Process Integration version 7.30 SAP NetWeaver Process Integration version 7.31 SAP NetWeaver Process Integration version 7.40 SAP NetWeaver Process Integration version 7.50

Description The issue is related to insufficient validation of user-controlled inputs, allowing an attacker with admin privileges to inject malicious scripts in certain servlets. This can lead to reflected Cross Site Scripting, enabling the attacker to read and modify data from the victim's browser when the victim clicks on malicious links. The vulnerability can be exploited remotely, allowing for cross-site scripting attacks.

Recommendations For SAP NetWeaver Process Integration version 7.10, update to a version that includes input validation to prevent Cross Site Scripting attacks. For SAP NetWeaver Process Integration version 7.11, update to a version that includes input validation to prevent Cross Site Scripting attacks. For SAP NetWeaver Process Integration version 7.20, update to a version that includes input validation to prevent Cross Site Scripting attacks. For SAP NetWeaver Process Integration version 7.30, update to a version that includes input validation to prevent Cross Site Scripting attacks. For SAP NetWeaver Process Integration version 7.31, update to a version that includes input validation to prevent Cross Site Scripting attacks. For SAP NetWeaver Process Integration version 7.40, update to a version that includes input validation to prevent Cross Site Scripting attacks. For SAP NetWeaver Process Integration version 7.50, update to a version that includes input validation to prevent Cross Site Scripting attacks. As a temporary workaround, consider restricting access to the vulnerable servlets until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-00638

CVE-2019-0316

Affected Products

Sap Netweaver Process Integration

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-0316 · Security Note
• https://osv.dev/vulnerability/CVE-2019-0316 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2745917 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00638 · Security Note
• https://cxsecurity.com/cveshow/CVE-2019-0316 · Note