PT-2019-4586 · Sap · Sap Netweaver Application Server Java

Published 2019-07-09 · Updated 2019-07-18 · CVE-2019-0327

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SAP NetWeaver for Java Application Server - Web Container versions 7.1 through 7.5

Description The issue allows an attacker to upload files, including script files, without proper file format validation. This can be exploited by a remote attacker to upload malicious files.

Recommendations For versions 7.1 through 7.5, consider implementing proper file format validation to prevent the upload of malicious files. As a temporary workaround, restrict access to the file upload functionality until a proper fix is applied.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2020-00646

CVE-2019-0327

Affected Products

Sap Netweaver Application Server Java

References · 6

• https://launchpad.support.sap.com/#/notes/2777910 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0327 · Security Note
• https://bdu.fstec.ru/vul/2020-00646 · Security Note
• https://osv.dev/vulnerability/CVE-2019-0327 · Vendor Advisory
• http://securityfocus.com/bid/109071 · Note