CVE-2019-0319: sap_se sap gateway Injection

Vulnerability summary

CVE-2019-0319 is a high (CVSS 7.5) Injection vulnerability in sap_se sap gateway. EPSS estimates a 2.51% chance of exploitation in the next 30 days, higher than 84.6% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 10-07-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could thus mislead a user to believe this information is from the legitimate service when it's not.

• CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.