CVE-2019-0298

SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP-CRMAPP SAP-SHRAPP, versions 7.30, 7.31, 7.32, 7.33, 7.54.

Score

CVSS 3.0 6.1 Medium

Status

Modified - cna@sap.com

Published

2019-05-14

Last modified

2024-08-04

Weaknesses

CWE-79

Affected products

• E-commerce (Sap)
• Sap-crmapp (Sap Se)
• Sap-crmweb (Sap Se)
• Sap-shrapp (Sap Se)
• Sap-shrjav (Sap Se)
• Sap-shrweb (Sap Se)
• Sap E-commerce Sap-crmjav (Sap Se)

References

• http://www.securityfocus.com/bid/108314
• https://launchpad.support.sap.com/#/notes/2773086
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032