CVE-2019-0312

published 2019-06-12

CVE-2019-0312: Several web pages provided SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 and SAP_XITOOL: 7.10 to 7.11…

Priority P4 27 medium 5.3 CVSS 3.0

AV N AC L PR N UI N S U C L I N A N

Several web pages provided SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 and SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50) are not password protected. An attacker could access landscape information like host names, ports or other technical data in the absence of restrictive firewall and port settings.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
sap	netweaver_process_integration	—	—
sap	netweaver_process_integration	—	—
sap	netweaver_process_integration	—	—
sap	netweaver_process_integration	—	—
sap	netweaver_process_integration	—	—
sap	netweaver_process_integration	—	—
sap	netweaver_process_integration	—	—
sap_se	sap_netweaver_process_integration	< 7.10 to 7.11	7.10 to 7.11
sap_se	sap_netweaver_process_integration	< 7.20	7.20
sap_se	sap_netweaver_process_integration	< 7.30	7.30
sap_se	sap_netweaver_process_integration	< 7.31	7.31
sap_se	sap_netweaver_process_integration	< 7.40	7.40
sap_se	sap_netweaver_process_integration	< 7.50	7.50

CVSS provenance

nvd v3.0 5.3 MEDIUM CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-306