Authentication Bypass Vulnerability in SAP NetWeaver Process Integration
CVE-2019-0282

5.3MEDIUM

Key Information:

Vendor
SAP
Status
SAP Netweaver Process Integration (runtime Workbench)
Vendor
CVE Published:
10 April 2019

Summary

Several web pages in SAP NetWeaver Process Integration allow access without user authentication, exposing sensitive internal data such as release information and Java object names. This lack of proper access controls may enable unauthorized users to exploit the information for malicious purposes. It is crucial for organizations using affected versions to implement the provided patches to mitigate potential risks.

Affected Version(s)

SAP NetWeaver Process Integration (Runtime Workbench) < from 7.10 to 7.11 < from 7.10 to 7.11

SAP NetWeaver Process Integration (Runtime Workbench) < 7.30 < 7.30

SAP NetWeaver Process Integration (Runtime Workbench) < 7.31 < 7.31

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_CONFIRM
https://launchpad.support.sap.com/#/notes/2742758
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.