Exposure of Sensitive Data in SAP NetWeaver Process Integration Products
CVE-2019-0312

5.3MEDIUM

Key Information:

Vendor
SAP
Status
SAP Netweaver Process Integration(SAP Xiesr)
SAP Netweaver Process Integration(SAP Xitool)
Vendor
CVE Published:
12 June 2019

Summary

Several web pages in SAP NetWeaver Process Integration lack proper authentication, allowing unauthorized users to access sensitive landscape information such as host names and technical data. The absence of secure firewall and port configurations increases the risk of exploitation, potentially leading to unauthorized access to critical system details.

Affected Version(s)

SAP NetWeaver Process Integration(SAP_XIESR) < 7.10 to 7.11 < 7.10 to 7.11

SAP NetWeaver Process Integration(SAP_XIESR) < 7.20 < 7.20

SAP NetWeaver Process Integration(SAP_XIESR) < 7.30 < 7.30

References

https://launchpad.support.sap.com/#/notes/2744086
x_refsource_MISC
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.