PT-2019-4584 · Sap · Sap Netweaver Application Server Java

Published 2019-07-09 · Updated 2020-08-24 · CVE-2019-0318

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server for Java (Startup Framework) versions 7.21, 7.22, 7.45, 7.49, and 7.53

Description The issue is related to the lack of protection for internal data in the Startup Framework component of the SAP NetWeaver Application Server for Java. This allows an attacker to access restricted information under certain conditions. The exploitation of this issue may enable a remote attacker to disclose protected information.

Recommendations For versions 7.21, 7.22, 7.45, 7.49, and 7.53, update to a version that includes the fix for this issue to prevent unauthorized access to restricted information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2020-00644

CVE-2019-0318

Affected Products

Sap Netweaver Application Server Java

References · 6

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00644 · Security Note
• https://launchpad.support.sap.com/#/notes/2738791 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-0318 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0318 · Security Note
• http://securityfocus.com/bid/109069 · Note