PT-2019-4583 · Sap · Sap Gateway

Rafael Fontes Souza · Published 2019-07-09 · Updated 2020-08-24 · CVE-2019-0319

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions SAP Gateway versions 7.5 through 7.53

Description The issue allows an attacker to inject content that is displayed as an error message, potentially misleading users into believing the information comes from a legitimate service. This is due to the lack of measures to neutralize special elements, which could allow a remote attacker to impact data integrity.

Recommendations For SAP Gateway versions 7.5 through 7.53, consider implementing measures to neutralize special elements and validate user input to prevent content injection. As a temporary workaround, restrict access to error messages that could be manipulated by an attacker.

Exploit

Fix

Special Elements Injection

XSS

Weakness Enumeration

CWE-74

CWE-79

Related Identifiers

BDU:2020-00643

CVE-2019-0319

Affected Products

Sap Gateway

References · 10

• 🔥 http://packetstormsecurity.com/files/153661/SAPUI5-1.0.0-SAP-Gateway-7.5-7.51-7.52-7.53-Content-Spoofing.html · Exploit
• 🔥 https://drive.google.com/open?id=1aGFqggvydehSK7MFIsfKW7tO60yiF55f · Exploit
• https://bdu.fstec.ru/vul/2020-00643 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0319 · Security Note
• https://launchpad.support.sap.com/#/notes/2752614 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-0319 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2911267 · Note
• http://securityfocus.com/bid/109074 · Note
• https://cxsecurity.com/ascii/WLB-2019050283 · Note