CVE-2019-0345
A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP Management console, resulting in Server-Side Request Forgery.
- Score
- CVSS 3.0 9.8 Critical
- Status
- Modified - cna@sap.com
- Published
- 2019-08-14
- Last modified
- 2024-08-04
- Weaknesses
- CWE-918
Affected products
- Netweaver Application Server Java (Sap)
- Sap Netweaver Application Server For Java Administrator System Overview (Sap Se)
References
- https://launchpad.support.sap.com/#/notes/2813811
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017
