CVE-2019-0316: sap se sap netweaver process integration(sap_xiesr) Cross-site Scripting
Vulnerability summary
CVE-2019-0316 is a medium (CVSS 4.8) Cross-site Scripting vulnerability in sap se sap netweaver process integration(sap_xiesr). EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 49% of scored vulnerabilities.
Timeline
- 14-06-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
SAP NetWeaver Process Integration, versions: SAP_XIESR: 7.20, SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate user-controlled inputs, which allows an attacker possessing admin privileges to read and modify data from the victim’s browser, by injecting malicious scripts in certain servlets, which will be executed when the victim is tricked to click on those malicious links, resulting in reflected Cross Site Scripting vulnerability.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.62%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
-0.21 pp
From 0.83% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Sap se2 products
- sap netweaver process integration(sap_xiesr)< 7.20
- sap netweaver process integration(sap_xitool)< 7.10 to 7.11 | < 7.30 | < 7.31 | < 7.40 | < 7.50
Sap1 product
- netweaver_process_integration7.10 | 7.11 | 7.20 | 7.30 | 7.31 | 7.40 | 7.50
2 vendors · 3 products