Multiple vulnerabilities in SAP products
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 14 |
| CVE-ID | CVE-2019-0266 CVE-2019-0261 CVE-2019-0265 CVE-2019-0258 CVE-2019-0255 CVE-2019-0254 CVE-2019-0251 CVE-2019-0259 CVE-2019-0267 CVE-2019-0256 CVE-2019-0257 CVE-2019-0262 CVE-2018-8039 CVE-2018-1002204 |
| CWE-ID | CWE-200 CWE-592 CWE-611 CWE-862 CWE-264 CWE-79 CWE-434 CWE-352 CWE-300 CWE-22 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #14 is available. |
| Vulnerable software |
SAP HANA Server applications / Database software SAP Landscape Management Web applications / Remote management & hosting panels SAP Disclosure Management Web applications / Remote management & hosting panels ABAP Platform Server applications / Application servers SAP BusinessObjects Business Intelligence suite Server applications / Other server solutions SAP Manufacturing Integration and Intelligence Client/Desktop applications / Other client software SAP Enterprise Architecture Designer Client/Desktop applications / Other client software SAP Business One Mobile applications / Apps for mobile phones SAP WebIntelligence BI LaunchPad Client/Desktop applications / Software for system administration |
| Vendor | SAP |
Security Bulletin
This security bulletin contains information about 14 vulnerabilities.
1) Information disclosure
EUVDB-ID: #VU17657
Risk: Low
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2019-0266
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to unspecified flaw. A remote attacker can gain unauthorized access to sensitive information on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSAP HANA: 1.00
CPE2.3 External linkshttps://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922950
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Authentication bypass
EUVDB-ID: #VU17658
Risk: Low
CVSSv4.0: 8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2019-0261
CWE-ID:
CWE-592 - Authentication Bypass Issues
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass authentication.
The weakness exists due to missing authentication check. A remote attacker can bypass authentication and perform unauthorized actions.
Install update from vendor's website.
Vulnerable software versionsSAP Landscape Management: 3.0
CPE2.3 External linkshttps://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922950
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) XXE attack
EUVDB-ID: #VU17659
Risk: Medium
CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2019-0265
CWE-ID:
CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')
Exploit availability: No
DescriptionThe vulnerability allows a remote high-privileged attacker to conduct XXE-attack.
The vulnerability exists due to improper handling of XML External Entities (XXEs) when parsing an XML file. A remote attacker can submit a specially crafted input and obtain potentially sensitive information or cause the service to crash.
MitigationInstall update from vendor's website.
Vulnerable software versionsABAP Platform: KRNL32NUC 7.21EXT - 7.21EXT
CPE2.3- cpe:2.3:a:sap:abap_platform:KRNL32NUC 7.21EXT:*:*:*:*:*:*:*
- cpe:2.3:a:sap:abap_platform:KRNL32UC 7.21:*:*:*:*:*:*:*
- cpe:2.3:a:sap:abap_platform:KRNL32NUC 7.21:*:*:*:*:*:*:*
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922950
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Authorization bypass
EUVDB-ID: #VU17660
Risk: Low
CVSSv4.0: 6.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2019-0258
CWE-ID:
CWE-862 - Missing Authorization
Exploit availability: No
DescriptionThe vulnerability allows a remote low-privileged attacker to bypass authorization.
The weakness exists due to missing authentication check. A remote attacker can bypass authorization and perform unauthorized actions.
Install update from vendor's website.
Vulnerable software versionsSAP Disclosure Management: 10.01
CPE2.3 External linkshttps://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922950
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Security restrictions bypass
EUVDB-ID: #VU17661
Risk: Low
CVSSv4.0: 5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2019-0255
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote low-privileged attacker to bypass security restrictions.
The weakness exists due to ABAP Platform provides access to Easy Access Menu. A remote attacker can bypass security restrictions and perform unauthorized actions.
Install update from vendor's website.
Vulnerable software versionsABAP Platform: Kernel 7.73 - Krnl64nuc 7.74
CPE2.3- cpe:2.3:a:sap:abap_platform:Kernel 7.73:*:*:*:*:*:*:*
- cpe:2.3:a:sap:abap_platform:Kernel 7.74:*:*:*:*:*:*:*
- cpe:2.3:a:sap:abap_platform:Kernel 7.75:*:*:*:*:*:*:*
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922950
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Cross-site scripting
EUVDB-ID: #VU17724
Risk: Low
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: CVE-2019-0254
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall update from vendor's website.
Vulnerable software versionsSAP Disclosure Management: 10.01 Stack 1301
CPE2.3 External linkshttps://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922950
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Cross-site scripting
EUVDB-ID: #VU17729
Risk: Low
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: CVE-2019-0251
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall update from vendor's website.
Vulnerable software versionsSAP BusinessObjects Business Intelligence suite: 4.2 - 4.3
CPE2.3- cpe:2.3:a:sap:sap_businessobjects:4.2:*:*:*:*:*:*:*
- cpe:2.3:a:sap:sap_businessobjects:4.3:*:*:*:*:*:*:*
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922950
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Unrestricted file upload
EUVDB-ID: #VU17730
Risk: Low
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2019-0259
CWE-ID:
CWE-434 - Unrestricted Upload of File with Dangerous Type
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass security restrictions.
The vulnerability exists due to unrestricted file upload. A remote attacker can supply specially crafted input, trick the victim into processing it and bypass security restrictions to conduct further attacks.
MitigationInstall update from vendor's website.
Vulnerable software versionsSAP BusinessObjects Business Intelligence suite: 4.2 - 4.3
CPE2.3- cpe:2.3:a:sap:sap_businessobjects:4.2:*:*:*:*:*:*:*
- cpe:2.3:a:sap:sap_businessobjects:4.3:*:*:*:*:*:*:*
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922950
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Cross-site request forgery
EUVDB-ID: #VU17731
Risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2019-0267
CWE-ID:
CWE-352 - Cross-Site Request Forgery (CSRF)
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
MitigationInstall update from vendor's website.
Vulnerable software versionsSAP Manufacturing Integration and Intelligence: 15.0 - 15.2
CPE2.3- cpe:2.3:a:sap:sap_manufacturing_integration_and_intelligence:15.0:*:*:*:*:*:*:*
- cpe:2.3:a:sap:sap_manufacturing_integration_and_intelligence:15.1:*:*:*:*:*:*:*
- cpe:2.3:a:sap:sap_manufacturing_integration_and_intelligence:15.2:*:*:*:*:*:*:*
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922950
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
10) Information disclosure
EUVDB-ID: #VU17732
Risk: Low
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2019-0256
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to unspecified flaw. A remote attacker can gain unauthorized access to sensitive information on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSAP Business One: 1.2.12
CPE2.3 External linkshttps://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922950
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
11) Authorization bypass
EUVDB-ID: #VU17733
Risk: Low
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2019-0257
CWE-ID:
CWE-862 - Missing Authorization
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass authorization.
The vulnerability exists due to missing authentication. A remote attacker can bypass authorization to conduct further attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsABAP Platform: 7.0 - 7.75
CPE2.3- cpe:2.3:a:sap:abap_platform:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:sap:abap_platform:7.01:*:*:*:*:*:*:*
- cpe:2.3:a:sap:abap_platform:7.02:*:*:*:*:*:*:*
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922950
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
12) Cross-site scripting
EUVDB-ID: #VU17734
Risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: CVE-2019-0262
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall update from vendor's website.
Vulnerable software versionsSAP WebIntelligence BI LaunchPad: 4.10 - 4.20
CPE2.3- cpe:2.3:a:sap:sap_webintelligence_bi_launchpad:4.10:*:*:*:*:*:*:*
- cpe:2.3:a:sap:sap_webintelligence_bi_launchpad:4.20:*:*:*:*:*:*:*
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922950
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
13) Man-in-the-middle attack
EUVDB-ID: #VU13523
Risk: Low
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2018-8039
CWE-ID:
CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
Exploit availability: No
DescriptionThe vulnerability allows a remote authenticated attacker to conduct man-in-the-middle attack on the target system.
The weakness exists due to improper verification of TLS hostnames when used with the 'com.sun.net.ssl' implementation. A remote attacker can conduct a man-in-the-middle attack and bypass the hostname verification.
Install update from vendor's website.
Vulnerable software versionsSAP Enterprise Architecture Designer: 1.0 SP04
CPE2.3 External linkshttps://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922950
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
14) Path traversal
EUVDB-ID: #VU14135
Risk: High
CVSSv4.0: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]
CVE-ID: CVE-2018-1002204
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to conduct a directory traversal attack on the target system.
The vulnerability exists in the extractDir() function of QuaZIP due to improper validation of files inside an archive file. A remote unauthenticated attacker can trick the victim into extracting an archive file that contains a file using directory traversal characters, and cause the service to crash or execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: This vulnerability is also known as 'Zip-Slip'.
MitigationInstall update from vendor's website.
Vulnerable software versionsSAP Enterprise Architecture Designer: 1.0 SP04
CPE2.3 External linkshttps://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922950
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
