CVE-2019-0316: XSS
First published: Fri Jun 14 2019(Updated: )
SAP NetWeaver Process Integration, versions: SAP_XIESR: 7.20, SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate user-controlled inputs, which allows an attacker possessing admin privileges to read and modify data from the victim’s browser, by injecting malicious scripts in certain servlets, which will be executed when the victim is tricked to click on those malicious links, resulting in reflected Cross Site Scripting vulnerability.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP NetWeaver Process Integration | =7.10 | |
| SAP NetWeaver Process Integration | =7.11 | |
| SAP NetWeaver Process Integration | =7.20 | |
| SAP NetWeaver Process Integration | =7.30 | |
| SAP NetWeaver Process Integration | =7.31 | |
| SAP NetWeaver Process Integration | =7.40 | |
| SAP NetWeaver Process Integration | =7.50 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-0316?
CVE-2019-0316 is a vulnerability in SAP NetWeaver Process Integration that allows an attacker with admin privileges to read and modify data from the victim's browser.
How is CVE-2019-0316 classified?
CVE-2019-0316 is classified as a medium severity vulnerability.
Which versions of SAP NetWeaver Process Integration are affected by CVE-2019-0316?
SAP NetWeaver Process Integration versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 are affected by CVE-2019-0316.
How can an attacker exploit CVE-2019-0316?
An attacker with admin privileges can inject malicious script to read and modify data from the victim's browser.
How can I fix CVE-2019-0316?
Apply the necessary patches provided by SAP and follow the recommended security guidelines.
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/type
- agent/tags
- agent/description
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/sap
- canonical/sap netweaver process integration
- version/sap netweaver process integration/7.10
- version/sap netweaver process integration/7.11
- version/sap netweaver process integration/7.20
- version/sap netweaver process integration/7.30
- version/sap netweaver process integration/7.31
- version/sap netweaver process integration/7.40
- version/sap netweaver process integration/7.50