CVE-2019-0345

Published: Aug 14, 2019Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP Management console, resulting in Server-Side Request Forgery.

Affected (4)

Products: Sap: Netweaver Application Server Java

Sap

1 product

Netweaver Application Server Java

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Sap Netweaver Application Server Java	Version 7.30
Sap Netweaver Application Server Java	Version 7.31
Sap Netweaver Application Server Java	Version 7.40
Sap Netweaver Application Server Java	Version 7.50