CVE-2019-0328

ABAP Tests Modules (SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5) of SAP NetWeaver Process Integration enables an attacker the execution of OS commands with privileged rights. An attacker could thereby impact the integrity and availability of the system.

CVSS v3 7.2 HIGH
CVSS v2.0 9.0 HIGH

7.2^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.securityfocus.com/bid/109067	Third Party Advisory VDB Entry
https://launchpad.support.sap.com/#/notes/2774489	Permissions Required Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sap:netweaver_process_integration:7.0:::::::*
	cpe:2.3:a:sap:netweaver_process_integration:7.1:::::::*
	cpe:2.3:a:sap:netweaver_process_integration:7.3:::::::*
	cpe:2.3:a:sap:netweaver_process_integration:7.4:::::::*
	cpe:2.3:a:sap:netweaver_process_integration:7.5:::::::*
	cpe:2.3:a:sap:netweaver_process_integration:7.31:::::::*

History

No history.

Information

Published : 2019-07-10 20:15

Updated : 2023-12-10 12:59

NVD link : CVE-2019-0328

Mitre link : CVE-2019-0328

CVE.ORG link : CVE-2019-0328

JSON object : View

Products Affected

sap

netweaver_process_integration

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2019-0328", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2019-07-10T20:15:12.123", "references": [{"url": "http://www.securityfocus.com/bid/109067", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cna@sap.com"}, {"url": "https://launchpad.support.sap.com/#/notes/2774489", "tags": ["Permissions Required", "Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "ABAP Tests Modules (SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5) of SAP NetWeaver Process Integration enables an attacker the execution of OS commands with privileged rights. An attacker could thereby impact the integrity and availability of the system."}, {"lang": "es", "value": "ABAP Tests Modules (SAP Basis, versiones 7.0, 7.1, 7.3, 7.31, 7.4, 7.5) de SAP NetWeaver Process Integration, permiten a un atacante la ejecuci\u00f3n de comandos del sistema operativo con derechos privilegiados. Un atacante podr\u00eda afectar la integridad y disponibilidad del sistema."}], "lastModified": "2019-07-18T13:37:49.993", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:netweaver_process_integration:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1785FB0A-AC85-4BFC-A9E2-41A9664D8DAA"}, {"criteria": "cpe:2.3:a:sap:netweaver_process_integration:7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6594C3CC-D474-4FB7-8B00-C6303EC6F254"}, {"criteria": "cpe:2.3:a:sap:netweaver_process_integration:7.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E23F15D6-6410-4255-9D96-D4795CCB33A7"}, {"criteria": "cpe:2.3:a:sap:netweaver_process_integration:7.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A673172-AFA8-4613-9A1D-CC994395DB31"}, {"criteria": "cpe:2.3:a:sap:netweaver_process_integration:7.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7482316A-99DB-48B2-ABEF-645BC92ACB01"}, {"criteria": "cpe:2.3:a:sap:netweaver_process_integration:7.31:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "587D81FB-B2ED-4184-9258-A38A18B36DC5"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}