7.2
CVE-2019-0327
- EPSS 2.1%
- Veröffentlicht 10.07.2019 20:15:12
- Zuletzt bearbeitet 21.11.2024 04:16:41
- Quelle cna@sap.com
- CVE-Watchlists
- Unerledigt
LoginSAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4, 7.5), allows an attacker to upload files (including script files) without proper file format validation.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
SAP ≫ Netweaver Application Server Java Version7.10
SAP ≫ Netweaver Application Server Java Version7.20
SAP ≫ Netweaver Application Server Java Version7.30
SAP ≫ Netweaver Application Server Java Version7.31
SAP ≫ Netweaver Application Server Java Version7.40
SAP ≫ Netweaver Application Server Java Version7.50
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 2.1% | 0.793 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.2 | 1.2 | 5.9 |
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 6.5 | 8 | 6.4 |
AV:N/AC:L/Au:S/C:P/I:P/A:P
|
CWE-434 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
http://www.securityfocus.com/bid/109071
https://launchpad.support.sap.com/#/notes/2777910