Reflected Cross-Site Scripting Vulnerability in SAP NetWeaver Process Integration
CVE-2019-0337

6.1MEDIUM

Key Information:

Vendor
SAP
Status
SAP Netweaver Process Integration (java Proxy Runtime)
Vendor
CVE Published:
14 August 2019

Summary

The Java Proxy Runtime of SAP NetWeaver Process Integration is vulnerable due to inadequate encoding of user-controlled inputs. This weakness enables attackers to inject and execute malicious scripts via URLs, leading to potential exploitation through reflected cross-site scripting (XSS) attacks. Such vulnerabilities can compromise user sessions and may allow attackers to manipulate web sessions or steal sensitive data.

Affected Version(s)

SAP NetWeaver Process Integration (Java Proxy Runtime) < 7.10 < 7.10

SAP NetWeaver Process Integration (Java Proxy Runtime) < 7.11 < 7.11

SAP NetWeaver Process Integration (Java Proxy Runtime) < 7.30 < 7.30

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2789866
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.