PT-2019-5669 · Sap · Sap Gateway

Published 2019-08-13 · Updated 2019-08-26 · CVE-2019-0338

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Gateway versions 750 through 753

Description The issue is related to the improper setting of HTTP Header attributes cache-control and pragma during an OData V2/V4 request, allowing an attacker to access restricted information. This results in information disclosure. The vulnerability is associated with a lack of protection for service data in the SAP Gateway environment, which can be exploited by a remote attacker to disclose protected information due to incorrectly set HTTP headers.

Recommendations For SAP Gateway versions 750 through 753, update the HTTP Header attributes to properly set cache-control and pragma to prevent information disclosure. As a temporary workaround, consider restricting access to sensitive information until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2020-04960

CVE-2019-0338

Affected Products

Sap Gateway

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-0338 · Security Note
• https://bdu.fstec.ru/vul/2020-04960 · Security Note
• https://osv.dev/vulnerability/CVE-2019-0338 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2793351 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0338 · Note