CVE-2019-0355 - SAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and SAP-JEECOR (before versions 6.40, 7.0, 7.01), allows an attacker to inject code that can be executed by the application

Back Back to CVE browser

HIGH

SAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and SAP-JEECOR (before versions 6.40, 7.0, 7.01), allows an attacker to inject code that can be executed by the application

Published Sep 10, 2019

7.2

HIGH

CVSS 3.1

EPSS 1.56%

Description

SAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and SAP-JEECOR (before versions 6.40, 7.0, 7.01), allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application.

Affected products

Vendor SAP SE Product SAP NetWeaver AS for Java (Web Container)-ENGINEAPI Default
n/a
- Version
  < 7.10
  Status
  affected
  Constraints
  -
- Version
  < 7.20
  Status
  affected
  Constraints
  -
- Version
  < 7.30
  Status
  affected
  Constraints
  -
- Version
  < 7.31
  Status
  affected
  Constraints
  -
- Version
  < 7.40
  Status
  affected
  Constraints
  -
- Version
  < 7.50
  Status
  affected
  Constraints
  -
Vendor SAP SE Product SAP NetWeaver AS for Java (Web Container)-SAP-JEECOR Default
n/a
- Version
  < 6.40
  Status
  affected
  Constraints
  -
- Version
  < 7.0
  Status
  affected
  Constraints
  -
- Version
  < 7.01
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

SAP NetWeaver AS for Java (Web Container)-ENGINEAPI

n/a

Version	Status	Constraints
< 7.10	affected	-
< 7.20	affected	-
< 7.30	affected	-
< 7.31	affected	-
< 7.40	affected	-
< 7.50	affected	-

SAP SE

SAP NetWeaver AS for Java (Web Container)-SAP-JEECOR

n/a

Version	Status	Constraints
< 6.40	affected	-
< 7.0	affected	-
< 7.01	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-1128
Advisory
https://launchpad.support.sap.com/#/notes/2798336
x_refsource_MISCPermissions RequiredThird Party Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506
x_refsource_CONFIRMThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-1128		Advisory
https://launchpad.support.sap.com/#/notes/2798336		x_refsource_MISCPermissions RequiredThird Party Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506		x_refsource_CONFIRMThird Party Advisory