CVE-2019-0275

SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server (J2EE-APPS), versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40 and 7.50, does not sufficiently encode user-controlled inputs, which results in cross-site scripting (XSS) vulnerability.

Score

CVSS 3.1 5.4 Medium

Status

Modified - cna@sap.com

Published

2019-03-12

Last modified

2024-08-04

Weaknesses

CWE-79

Affected products

• Netweaver Application Server Java (Sap)
• Sap Netweaver Java Application Server J2ee-apps (Sap Se)

References

• http://www.securityfocus.com/bid/107362
• https://launchpad.support.sap.com/#/notes/2689925
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080