CVE-2019-0355: sap se sap netweaver as for java (web container)-engineapi Code Injection
Vulnerability summary
CVE-2019-0355 is a high (CVSS 7.2) Code Injection vulnerability in sap se sap netweaver as for java (web container)-engineapi. EPSS estimates a 1.56% chance of exploitation in the next 30 days, higher than 75% of scored vulnerabilities.
Timeline
- 10-09-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
SAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and SAP-JEECOR (before versions 6.40, 7.0, 7.01), allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.56%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.56% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Sap se2 products
- sap netweaver as for java (web container)-engineapi< 7.10 | < 7.20 | < 7.30 | < 7.31 | < 7.40 | < 7.50
- sap netweaver as for java (web container)-sap-jeecor< 6.40 | < 7.0 | < 7.01
Sap1 product
- netweaver_application_server_java7.10 | 7.20 | 7.30 | 7.31 | 7.40 | 7.50
2 vendors · 3 products