CVE-2019-0283: sap se sap netweaver process integration (adapter engine) Authentication Bypass by Spoofing
Vulnerability summary
CVE-2019-0283 is a high (CVSS 7.1) Authentication Bypass by Spoofing vulnerability in sap se sap netweaver process integration (adapter engine). EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48.5% of scored vulnerabilities.
Timeline
- 10-04-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital Signature Spoofing. It is possible to spoof XML signatures and send arbitrary requests to the server via PI Axis adapter. These requests will be accepted by the PI Axis adapter even if the payload has been altered, especially when the signed element is the body of the xml document.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.61%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
-0.13 pp
From 0.74% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Sap1 product
- netweaver_process_integration7.10 | 7.11 | 7.30 | 7.31 | 7.40 | 7.50
Sap se1 product
- sap netweaver process integration (adapter engine)< from 7.10 to 7.11 | < 7.30 | < 7.31 | < 7.40 | < 7.50
2 vendors · 2 products