CVE-2019-0370

CWE-913 documents3 sources
Severity
6.5MEDIUM
EPSS
0.3%
top 48.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP SE SAP Financial ConsolidationSAP Financial Consolidation
Timeline
PublishedOct 8
Latest updateMay 24

Description

Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to interfere with the structure of the surrounding query leading to XPath Injection.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitability: 3.9 | Impact: 2.5

Affected Packages2 packages

▶NVDsap/financial_consolidation10.0, 10.1+1

🔴Vulnerability Details

2
GHSA
GHSA-5p4v-rpm8-m6g3: Due to missing input validation, SAP Financial Consolidation, before versions 10↗2022-05-24
▶
CVEList
CVE-2019-0370: Due to missing input validation, SAP Financial Consolidation, before versions 10↗2019-10-08
▶