CVE-2019-0305
First published: Wed Jun 12 2019(Updated: )
Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not restrict or incorrectly restrict frame objects or UI layers that belong to another application or domain, resulting in Clickjacking vulnerability. Successful exploitation of this vulnerability leads to unwanted modification of user's data.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP NetWeaver Process Integration | =7.10 | |
| SAP NetWeaver Process Integration | =7.11 | |
| SAP NetWeaver Process Integration | =7.20 | |
| SAP NetWeaver Process Integration | =7.30 | |
| SAP NetWeaver Process Integration | =7.31 | |
| SAP NetWeaver Process Integration | =7.40 | |
| SAP NetWeaver Process Integration | =7.50 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-0305?
The severity of CVE-2019-0305 is medium with a score of 4.3.
Which software versions are affected by CVE-2019-0305?
The affected software versions of CVE-2019-0305 are SAP NetWeaver Process Integration 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50.
What is the Clickjacking vulnerability in CVE-2019-0305?
The Clickjacking vulnerability in CVE-2019-0305 occurs due to Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration not properly restricting frame objects or UI layers from another application or domain, allowing potential clickjacking attacks.
How can I fix the CVE-2019-0305 vulnerability?
To fix the CVE-2019-0305 vulnerability, it is recommended to apply the necessary patches provided by SAP and update the SAP NetWeaver Process Integration software to the latest version.
Where can I find more information about CVE-2019-0305?
You can find more information about CVE-2019-0305 on the SAP support portal at [https://launchpad.support.sap.com/#/notes/2755502](https://launchpad.support.sap.com/#/notes/2755502) and the SAP Community Network wiki at [https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242](https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242).
- collector/nvd-index
- agent/type
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/event
- agent/description
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/sap
- canonical/sap netweaver process integration
- version/sap netweaver process integration/7.10
- version/sap netweaver process integration/7.11
- version/sap netweaver process integration/7.20
- version/sap netweaver process integration/7.30
- version/sap netweaver process integration/7.31
- version/sap netweaver process integration/7.40
- version/sap netweaver process integration/7.50