8.8
CVE-2019-0267
- EPSS 0.2%
- Veröffentlicht 15.02.2019 18:29:02
- Zuletzt bearbeitet 21.11.2024 04:16:36
- Quelle cna@sap.com
- Teams Watchlist Login
- Unerledigt Login
SAP Manufacturing Integration and Intelligence, versions 15.0, 15.1 and 15.2, (Illuminator Servlet) currently does not provide Anti-XSRF tokens. This might lead to XSRF attacks in case the data is being posted to the Servlet from an external application.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
SAP ≫ Manufacturing Integration And Intelligence Version15.0
SAP ≫ Manufacturing Integration And Intelligence Version15.1
SAP ≫ Manufacturing Integration And Intelligence Version15.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.2% | 0.391 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 8.8 | 2.8 | 5.9 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 6.8 | 8.6 | 6.4 |
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.