Server-Side Request Forgery Vulnerability in SAP NetWeaver Application Server for Java
CVE-2019-0345

9.8CRITICAL

Key Information:

Vendor

SAP
Status
SAP Netweaver Application Server For Java (administrator System Overview)
Vendor
CVE Published:
14 August 2019

What is CVE-2019-0345?

An attacker without authentication can exploit a vulnerability in the SAP NetWeaver Application Server for Java by submitting a specially crafted XML file. This can lead to the exposure of sensitive authentication credentials within the SAP Management console. The flaw arises from the web service's inability to properly validate input, which could potentially allow unauthorized access to server functionalities. This vulnerability necessitates immediate attention to safeguard against unauthorized system access and credential leakage.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

SAP NetWeaver Application Server for Java (Administrator System Overview) < 7.30 < 7.30

SAP NetWeaver Application Server for Java (Administrator System Overview) < 7.31 < 7.31

SAP NetWeaver Application Server for Java (Administrator System Overview) < 7.40 < 7.40

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2813811
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.