CVE-2019-0319: XSS
First published: Wed Jul 10 2019(Updated: )
The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could thus mislead a user to believe this information is from the legitimate service when it's not.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP Gateway | =7.5 | |
| SAP Gateway | =7.51 | |
| SAP Gateway | =7.52 | |
| SAP Gateway | =7.53 | |
| SAP UI5 | =1.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/153661/SAPUI5-1.0.0-SAP-Gateway-7.5-7.51-7.52-7.53-Content-Spoofing.html
- http://www.securityfocus.com/bid/109074
- https://cxsecurity.com/ascii/WLB-2019050283
- https://drive.google.com/open?id=1aGFqggvydehSK7MFIsfKW7tO60yiF55f
- https://launchpad.support.sap.com/#/notes/2752614
- https://launchpad.support.sap.com/#/notes/2911267
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
Frequently Asked Questions
What is the vulnerability ID for this SAP Gateway vulnerability?
The vulnerability ID for this SAP Gateway vulnerability is CVE-2019-0319.
What is the severity level of CVE-2019-0319?
The severity level of CVE-2019-0319 is high with a severity value of 7.5.
Which versions of SAP Gateway are affected by this vulnerability?
The versions 7.5, 7.51, 7.52, and 7.53 of SAP Gateway are affected by this vulnerability.
How can an attacker exploit CVE-2019-0319?
An attacker can exploit CVE-2019-0319 by injecting content that is displayed as an error message, potentially misleading users.
Are there any known references for CVE-2019-0319?
Yes, you can find references for CVE-2019-0319 [here](http://packetstormsecurity.com/files/153661/SAPUI5-1.0.0-SAP-Gateway-7.5-7.51-7.52-7.53-Content-Spoofing.html), [here](http://www.securityfocus.com/bid/109074), and [here](https://cxsecurity.com/ascii/WLB-2019050283).
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- vendor/sap
- canonical/sap gateway
- version/sap gateway/7.5
- version/sap gateway/7.51
- version/sap gateway/7.52
- version/sap gateway/7.53
- canonical/sap ui5
- version/sap ui5/1.0.0