XPath Injection Vulnerability in SAP Financial Consolidation Software
CVE-2019-0370

6.5MEDIUM

Key Information:

Vendor
SAP
Status
SAP Financial Consolidation
Vendor
CVE Published:
8 October 2019

Summary

The vulnerability arises from inadequate input validation in SAP Financial Consolidation, which affects versions prior to 10.0 and 10.1. Attackers may exploit this weakness by providing specially crafted input, disrupting the structure of queries and enabling unauthorized access to sensitive information or manipulation of data. This poses significant risks regarding data integrity and confidentiality.

Affected Version(s)

SAP Financial Consolidation < 10.0 < 10.0

SAP Financial Consolidation < 10.1 < 10.1

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_CONFIRM
https://launchpad.support.sap.com/#/notes/2806403
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.