Server-Side Request Forgery Vulnerability in SAP NetWeaver Application Server for Java
CVE-2019-0345

9.8CRITICAL

Key Information:

Vendor
SAP
Status
SAP Netweaver Application Server For Java (administrator System Overview)
Vendor
CVE Published:
14 August 2019

Summary

An attacker without authentication can exploit a vulnerability in the SAP NetWeaver Application Server for Java by submitting a specially crafted XML file. This can lead to the exposure of sensitive authentication credentials within the SAP Management console. The flaw arises from the web service's inability to properly validate input, which could potentially allow unauthorized access to server functionalities. This vulnerability necessitates immediate attention to safeguard against unauthorized system access and credential leakage.

Affected Version(s)

SAP NetWeaver Application Server for Java (Administrator System Overview) < 7.30 < 7.30

SAP NetWeaver Application Server for Java (Administrator System Overview) < 7.31 < 7.31

SAP NetWeaver Application Server for Java (Administrator System Overview) < 7.40 < 7.40

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2813811
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.