PT-2019-5598 · Sap · Sap Netweaver Process Integration Runtime Workbench

Published 2019-09-10 · Updated 2020-09-10 · CVE-2019-0356

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP XIAF versions prior to 7.31, 7.40, 7.50

Description The issue is related to a lack of protection for internal data in the MESSAGING and SAP XIAF components of SAP NetWeaver Process Integration. Under certain conditions, this allows an attacker to access restricted information. The exploitation of this issue can enable a remote attacker to disclose protected information.

Recommendations For versions prior to 7.31, update to version 7.31 or later. For versions prior to 7.40, update to version 7.40 or later. For versions prior to 7.50, update to version 7.50 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2020-04625

CVE-2019-0356

Affected Products

Sap Netweaver Process Integration Runtime Workbench

References · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0356 · Security Note
• https://bdu.fstec.ru/vul/2020-04625 · Security Note
• https://osv.dev/vulnerability/CVE-2019-0356 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2802521 · Vendor Advisory