Sign-up

ID

VAR-201909-1446


CVE

CVE-2019-0356


TITLE

SAP NetWeaver Process Integration Runtime Workbench Vulnerable to information disclosure

Trust: 0.8

sources: JVNDB: JVNDB-2019-009155

DESCRIPTION

Under certain conditions SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF (before versions 7.31, 7.40, 7.50) allows an attacker to access information which would otherwise be restricted

Trust: 1.62

sources: NVD: CVE-2019-0356 // JVNDB: JVNDB-2019-009155

AFFECTED PRODUCTS

vendor:sapmodel:netweaver process integrationscope:eqversion:7.40

Trust: 1.0

vendor:sapmodel:netweaver process integrationscope:eqversion:7.50

Trust: 1.0

vendor:sapmodel:netweaver process integrationscope:eqversion:7.31

Trust: 1.0

vendor:sapmodel:netweaver process integrationscope:ltversion:7.31

Trust: 0.8

vendor:sapmodel:netweaver process integrationscope:ltversion:7.40

Trust: 0.8

vendor:sapmodel:netweaver process integrationscope:ltversion:7.50

Trust: 0.8

sources: JVNDB: JVNDB-2019-009155 // NVD: CVE-2019-0356

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-0356
value: MEDIUM

Trust: 1.0

NVD: CVE-2019-0356
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201909-437
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2019-0356
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

nvd@nist.gov: CVE-2019-0356
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 1.4
version: 3.1

Trust: 1.0

NVD: CVE-2019-0356
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2019-009155 // CNNVD: CNNVD-201909-437 // NVD: CVE-2019-0356

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-200

Trust: 0.8

sources: JVNDB: JVNDB-2019-009155 // NVD: CVE-2019-0356

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201909-437

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201909-437

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-009155

PATCH
title:SAP Security Patch Day - September 2019url:https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506
Trust: 0.8
title:SAP NetWeaver Process Integration Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=98031
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-009155 // 
            
            
            
            CNNVD: CNNVD-201909-437

EXTERNAL IDS
db:NVDid:CVE-2019-0356
Trust: 2.4
db:JVNDBid:JVNDB-2019-009155
Trust: 0.8
db:CNNVDid:CNNVD-201909-437
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-009155 // 
            
            
            
            CNNVD: CNNVD-201909-437 // 
            
            
            
            NVD: CVE-2019-0356

REFERENCES
url:https://launchpad.support.sap.com/#/notes/2802521
Trust: 1.6
url:https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageid=525962506
Trust: 1.6
url:https://nvd.nist.gov/vuln/detail/cve-2019-0356
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-0356
Trust: 0.8
url:https://vigilance.fr/vulnerability/sap-multiple-vulnerabilities-of-september-2019-30286
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-009155 // 
            
            
            
            CNNVD: CNNVD-201909-437 // 
            
            
            
            NVD: CVE-2019-0356

SOURCES
db:JVNDBid:JVNDB-2019-009155
db:CNNVDid:CNNVD-201909-437
db:NVDid:CVE-2019-0356

LAST UPDATE DATE
2024-11-23T22:37:42.173000+00:00

SOURCES UPDATE DATE
db:JVNDBid:JVNDB-2019-009155date:2019-09-13T00:00:00
db:CNNVDid:CNNVD-201909-437date:2020-08-25T00:00:00
db:NVDid:CVE-2019-0356date:2024-11-21T04:16:44.253

SOURCES RELEASE DATE
db:JVNDBid:JVNDB-2019-009155date:2019-09-13T00:00:00
db:CNNVDid:CNNVD-201909-437date:2019-09-10T00:00:00
db:NVDid:CVE-2019-0356date:2019-09-10T17:15:11