Server-Side Request Forgery Vulnerability in SAP NetWeaver Application Server for Java
CVE-2019-0345
Key Information:
- Vendor
- SAP
- Vendor
- CVE Published:
- 14 August 2019
Summary
An attacker without authentication can exploit a vulnerability in the SAP NetWeaver Application Server for Java by submitting a specially crafted XML file. This can lead to the exposure of sensitive authentication credentials within the SAP Management console. The flaw arises from the web service's inability to properly validate input, which could potentially allow unauthorized access to server functionalities. This vulnerability necessitates immediate attention to safeguard against unauthorized system access and credential leakage.
Affected Version(s)
SAP NetWeaver Application Server for Java (Administrator System Overview) < 7.30 < 7.30
SAP NetWeaver Application Server for Java (Administrator System Overview) < 7.31 < 7.31
SAP NetWeaver Application Server for Java (Administrator System Overview) < 7.40 < 7.40
References
CVSS V3.1
Timeline
Vulnerability published
Vulnerability Reserved