CVE-2019-0304
Estado: ModificadaCrítica (9.8)—
FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, allows an attacker to inject code or specifically manipulated command that can be executed by the application. An attacker could thereby control the behaviour of the application.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.63%
- Percentil entre todas las CVEs puntuadas: 75
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (5)
SAP — Advanced Business Application Programming Platform KernelSAP — Advanced Business Application Programming Platform Krnl32nucSAP — Advanced Business Application Programming Platform Krnl32ucSAP — Advanced Business Application Programming Platform Krnl64nucSAP — Advanced Business Application Programming Platform Krnl64uc
CWE
- CWE-74
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2019-0304",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cna@sap.com",
"affectedData": [
{
"vendor": "SAP SE",
"product": "SAP NetWeaver AS ABAP Platform(KRNL32NUC)",
"versions": [
{
"status": "affected",
"version": "< 7.21"
},
{
"status": "affected",
"version": "< 7.21EXT"
},
{
"status": "affected",
"version": "< 7.22"
},
{
"status": "affected",
"version": "< 7.22EXT"
}
]
},
{
"vendor": "SAP SE",
"product": "SAP NetWeaver AS ABAP Platform(KRNL32UC)",
"versions": [
{
"status": "affected",
"version": "< 7.21"
},
{
"status": "affected",
"version": "< 7.21EXT"
},
{
"status": "affected",
"version": "< 7.22"
},
{
"status": "affected",
"version": "< 7.22EXT"
}
]
},
{
"vendor": "SAP SE",
"product": "SAP NetWeaver AS ABAP Platform(KRNL64NUC)",
"versions": [
{
"status": "affected",
"version": "< 7.21"
},
{
"status": "affected",
"version": "< 7.21EXT"
},
{
"status": "affected",
"version": "< 7.22"
},
{
"status": "affected",
"version": "< 7.22EXT"
},
{
"status": "affected",
"version": "< 7.49"
}
]
},
{
"vendor": "SAP SE",
"product": "SAP NetWeaver AS ABAP Platform(KRNL64UC)",
"versions": [
{
"status": "affected",
"version": "< 7.21"
},
{
"status": "affected",
"version": "< 7.21EXT"
},
{
"status": "affected",
"version": "< 7.22"
},
{
"status": "affected",
"version": "< 7.22EXT"
},
{
"status": "affected",
"version": "< 7.49"
},
{
"status": "affected",
"version": "< 7.73"
}
]
},
{
"vendor": "SAP SE",
"product": "SAP NetWeaver AS ABAP Platform(KERNEL)",
"versions": [
{
"status": "affected",
"version": "< 7.21"
},
{
"status": "affected",
"version": "< 7.45"
},
{
"status": "affected",
"version": "< 7.49"
},
{
"status": "affected",
"version": "< 7.53"
},
{
"status": "affected",
"version": "< 7.73"
}
]
}
]
}
],
"published": "2019-06-12T15:29:00.223",
"references": [
{
"url": "https://launchpad.support.sap.com/#/notes/2719530",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"source": "cna@sap.com"
},
{
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242",
"tags": [
"Vendor Advisory"
],
"source": "cna@sap.com"
},
{
"url": "https://launchpad.support.sap.com/#/notes/2719530",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-74"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, allows an attacker to inject code or specifically manipulated command that can be executed by the application. An attacker could thereby control the behaviour of the application."
},
{
"lang": "es",
"value": "La función FTP de SAP NetWeaver AS ABAP Platform, versiones- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22EXT, 7.49, KRNL6464 7.21 EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, permite a un atacante inyectar un código o un comando específicamente manipulado que puede ser ejecutado por la aplicación. Por lo tanto, un atacante podría de este modo controlar el comportamiento de la aplicación."
}
],
"lastModified": "2026-06-17T02:08:09.027",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.21:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D8EBCD0F-ED63-4C55-9DB4-63DE8F0751CA"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.45:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3006D7F9-6D11-48A6-899B-2C2955C1A67D"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.49:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B2AFDC66-A5C4-4135-9A7F-1778B9DDF2EE"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.53:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4CB213CC-4C71-4B3A-9D9F-C83594597447"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.73:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "46C2954E-3626-4DC7-85CA-241B9E826337"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl32nuc:7.21:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ED21DC1E-A53A-4E92-83F0-7455EBEFA3A1"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl32nuc:7.21ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "93910493-4A5E-4E14-B6FD-6A5B175AE664"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl32nuc:7.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F6B9301C-C221-4345-A006-DA7B12E93D1B"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl32nuc:7.22ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8A2B2EC5-A03F-4EBB-BCAF-526DE7EFE2BD"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl32uc:7.21:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "940B8331-6D22-418A-9D17-B14DAB035FE1"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl32uc:7.21ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0D191560-7559-4D90-A593-261C4FD6458D"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl32uc:7.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "01A83003-D709-4E48-8CBE-2AA40274ADA7"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl32uc:7.22ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "471132DF-5B9A-4124-B75F-A09EA02C9CE2"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64nuc:7.21:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A50F5C48-173B-487A-8DD1-06A921E37602"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64nuc:7.21ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FD2EBEA5-D698-4595-A654-DEA58C948C78"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64nuc:7.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A901C3A0-E763-4133-9F1F-CDB5AE45A6E2"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64nuc:7.22ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EE5B551B-0CD5-4800-9A0D-B5B36AD6BCCD"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64nuc:7.49:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4ED75DB6-7FF6-43CD-9801-7C8410042833"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64uc:7.21:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9CC9A5B1-F1B2-4804-BABD-2CAEA06BCC42"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64uc:7.21ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C5D40A13-C630-4E43-A44B-76CAB09FF2C1"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64uc:7.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "26486715-DC64-4AC6-A60D-01254A75C19C"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64uc:7.22ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A6953A3D-8BD4-45DA-A872-6222CB6C1B77"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64uc:7.49:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4C3A6702-3A41-4DA5-B705-AAC77A097AC0"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64uc:7.73:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "80296DDD-A3B9-4A7F-B831-DC064A85CE38"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cna@sap.com"
}