CVE-2019-0245: XSS
First published: Tue Jan 08 2019(Updated: )
SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sap Customer Relationship Management Webclient Ui | =7.31 | |
| Sap Customer Relationship Management Webclient Ui | =7.46 | |
| Sap Customer Relationship Management Webclient Ui | =7.47 | |
| Sap Customer Relationship Management Webclient Ui | =7.48 | |
| Sap Customer Relationship Management Webclient Ui | =8.00 | |
| Sap Customer Relationship Management Webclient Ui | =8.01 | |
| Sap S4fnd | =1.02 | |
| Sap Sapscore | =1.12 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-0245?
CVE-2019-0245 is a Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI (fixed in SAPCORE 1.12, S4FND 1.02, WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) that allows attackers to inject malicious scripts into web pages viewed by users.
What is the severity of CVE-2019-0245?
The severity of CVE-2019-0245 is medium, with a CVSS base score of 5.4.
How does CVE-2019-0245 affect SAP CRM WebClient UI?
CVE-2019-0245 affects SAP CRM WebClient UI by not sufficiently encoding user-controlled inputs, allowing attackers to perform Cross-Site Scripting attacks.
Which versions of SAP CRM WebClient UI are affected by CVE-2019-0245?
The following versions of SAP CRM WebClient UI are affected by CVE-2019-0245: 7.31, 7.46, 7.47, 7.48, 8.0, and 8.01.
How can CVE-2019-0245 be fixed?
CVE-2019-0245 can be fixed by applying the relevant patches: SAPCORE 1.12, S4FND 1.02, and WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01.
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/type
- agent/tags
- agent/event
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- vendor/sap
- canonical/sap customer relationship management webclient ui
- version/sap customer relationship management webclient ui/7.31
- version/sap customer relationship management webclient ui/7.46
- version/sap customer relationship management webclient ui/7.47
- version/sap customer relationship management webclient ui/7.48
- version/sap customer relationship management webclient ui/8.00
- version/sap customer relationship management webclient ui/8.01
- canonical/sap s4fnd
- version/sap s4fnd/1.02
- canonical/sap sapscore
- version/sap sapscore/1.12