CVE-2019-0275: sap se sap netweaver java application server (j2ee-apps) Cross-site Scripting
Vulnerability summary
CVE-2019-0275 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in sap se sap netweaver java application server (j2ee-apps). EPSS estimates a 0.78% chance of exploitation in the next 30 days, higher than 55.4% of scored vulnerabilities.
Timeline
- 12-03-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server (J2EE-APPS), versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40 and 7.50, does not sufficiently encode user-controlled inputs, which results in cross-site scripting (XSS) vulnerability.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.78%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.78% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Sap1 product
- netweaver_application_server_java≥ 7.10, ≤ 7.11 | 7.20 | 7.30 | 7.31 | 7.40 | 7.50
Sap se1 product
- sap netweaver java application server (j2ee-apps)< 7.10 to 7.11 | < 7.20 | < 7.30 | < 7.31 | < 7.40 | < 7.50
2 vendors · 2 products