CVE-2019-0316: XSS
SAP NetWeaver Process Integration, versions: SAPXIESR: 7.20, SAPXITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate user-controlled inputs, which allows an attacker possessing admin privileges to read and modify data from the victim’s browser, by injecting malicious scripts in certain servlets, which will be executed when the victim is tricked to click on those malicious links, resulting in reflected Cross Site Scripting vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-0316?
CVE-2019-0316 is a vulnerability in SAP NetWeaver Process Integration that allows an attacker with admin privileges to read and modify data from the victim's browser.
How is CVE-2019-0316 classified?
CVE-2019-0316 is classified as a medium severity vulnerability.
Which versions of SAP NetWeaver Process Integration are affected by CVE-2019-0316?
SAP NetWeaver Process Integration versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 are affected by CVE-2019-0316.
How can an attacker exploit CVE-2019-0316?
An attacker with admin privileges can inject malicious script to read and modify data from the victim's browser.
How can I fix CVE-2019-0316?
Apply the necessary patches provided by SAP and follow the recommended security guidelines.