CVE-2019-0311 - Automotive Dealer Portal in SAP R/3 Enterprise Application (versions: 600, 602, 603, 604, 605, 606, 616, 617) does not sufficiently encode user-controlled inputs, this makes it possible for an attacker to send unwanted scripts to the browser of the victim using unwanted input and execute malicious code there, resulting in Cross-Site Scripting (XSS) vulnerability

Back Back to CVE browser

MEDIUM

Automotive Dealer Portal in SAP R/3 Enterprise Application (versions: 600, 602, 603, 604, 605, 606, 616, 617) does not sufficiently encode user-controlled inputs, this makes it possible for an attacker to send unwanted scripts to the browser of the victim using unwanted input and execute malicious code there, resulting in Cross-Site Scripting (XSS) vulnerability

Published Jun 12, 2019

6.1

MEDIUM

CVSS 3.0

EPSS 0.80%

Description

Automotive Dealer Portal in SAP R/3 Enterprise Application (versions: 600, 602, 603, 604, 605, 606, 616, 617) does not sufficiently encode user-controlled inputs, this makes it possible for an attacker to send unwanted scripts to the browser of the victim using unwanted input and execute malicious code there, resulting in Cross-Site Scripting (XSS) vulnerability.

Affected products

Vendor SAP SE Product SAP R/3 Enterprise Application Default
n/a
- Version
  < 6.0
  Status
  affected
  Constraints
  -
- Version
  < 6.02
  Status
  affected
  Constraints
  -
- Version
  < 6.03
  Status
  affected
  Constraints
  -
- Version
  < 6.04
  Status
  affected
  Constraints
  -
- Version
  < 6.05
  Status
  affected
  Constraints
  -
- Version
  < 6.06
  Status
  affected
  Constraints
  -
- Version
  < 6.16
  Status
  affected
  Constraints
  -
- Version
  < 6.17
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

SAP R/3 Enterprise Application

n/a

Version	Status	Constraints
< 6.0	affected	-
< 6.02	affected	-
< 6.03	affected	-
< 6.04	affected	-
< 6.05	affected	-
< 6.06	affected	-
< 6.16	affected	-
< 6.17	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-1084
Advisory
https://launchpad.support.sap.com/#/notes/2728153
x_refsource_MISCPermissions RequiredVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-1084		Advisory
https://launchpad.support.sap.com/#/notes/2728153		x_refsource_MISCPermissions RequiredVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242		x_refsource_MISCVendor Advisory