CVE-2019-0391
published 2019-11-13CVE-2019-0391: Under certain conditions SAP NetWeaver AS Java (corrected in 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) allows an attacker to access information which would otherwise…
PriorityP421medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.89%
55.1th percentile
Under certain conditions SAP NetWeaver AS Java (corrected in 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) allows an attacker to access information which would otherwise be restricted.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap | netweaver_application_server_java | — | — |
| sap | netweaver_application_server_java | — | — |
| sap | netweaver_application_server_java | — | — |
| sap | netweaver_application_server_java | — | — |
| sap | netweaver_application_server_java | — | — |
| sap | netweaver_application_server_java | — | — |
| sap_se | sap_netweaver_as_java | < 7.10 | 7.10 |
| sap_se | sap_netweaver_as_java | < 7.20 | 7.20 |
| sap_se | sap_netweaver_as_java | < 7.30 | 7.30 |
| sap_se | sap_netweaver_as_java | < 7.31 | 7.31 |
| sap_se | sap_netweaver_as_java | < 7.40 | 7.40 |
| sap_se | sap_netweaver_as_java | < 7.50 | 7.50 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6j4m-pp4h-r44g: Under certain conditions SAP NetWeaver AS Java (corrected in 7
ghsa_unreviewed·2022-05-24
CVE-2019-0391 [MEDIUM] GHSA-6j4m-pp4h-r44g: Under certain conditions SAP NetWeaver AS Java (corrected in 7
Under certain conditions SAP NetWeaver AS Java (corrected in 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) allows an attacker to access information which would otherwise be restricted.
Red Hat
struts: User input is evaluated as an OGNL expression when there's a conversion error
vendor_redhat·2011-08-05·CVSS 9.8
CVE-2012-0391 [CRITICAL] struts: User input is evaluated as an OGNL expression when there's a conversion error
struts: User input is evaluated as an OGNL expression when there's a conversion error
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
Statement: A previous statement by Red Hat related to this CVE, prior to August 2019, said that Apache Struts 2 is not included in any Red Hat products. This earlier statement was incorrect. While Struts 2 is not actively compiled, shipped, used, or enabled in any Red Hat provided final products, and does not cause any vulnerability in the product, struts2-core jars have been included in some products' source code packages. The inclus
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-11-13
Published