« Volver al listado

CVE-2019-0305

Estado: ModificadaMedia (4.3)—

Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not restrict or incorrectly restrict frame objects or UI layers that belong to another application or domain, resulting in Clickjacking vulnerability. Successful exploitation of this vulnerability leads to unwanted modification of user's data.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Netweaver Process Integration

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-0305",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP NetWeaver Process Integration(SAP_XIESR and SAP_XITOOL)",
          "versions": [
            {
              "status": "affected",
              "version": "< 7.10 to 7.11"
            },
            {
              "status": "affected",
              "version": "< 7.2"
            },
            {
              "status": "affected",
              "version": "< 7.3"
            },
            {
              "status": "affected",
              "version": "< 7.31"
            },
            {
              "status": "affected",
              "version": "< 7.4"
            },
            {
              "status": "affected",
              "version": "< 7.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-06-12T15:29:00.270",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/2755502",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2755502",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1021"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not restrict or incorrectly restrict frame objects or UI layers that belong to another application or domain, resulting in Clickjacking vulnerability. Successful exploitation of this vulnerability leads to unwanted modification of user's data."
    },
    {
      "lang": "es",
      "value": "Las páginas de servidor Java (JSP) proporcionadas por la integración de procesos de SAP NetWeaver (SAP_XIESR y SAP_XITOOL: versión 7.10 hasta 7.11, y versiones 7.20, 7.30, 7.31, 7.40, 7.50) no restringen o restringen incorrectamente los objetos frame o las capas IU que pertenecen a otra aplicación o dominio , resultando en una vulnerabilidad de tipo clickjacking. La explotación con éxito de esta vulnerabilidad conlleva a una modificación no deseada de los datos del usuario."
    }
  ],
  "lastModified": "2026-06-17T02:08:09.170",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:netweaver_process_integration:7.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "75E83C25-D30B-4459-A1F1-DE7EC9FD46BE"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_process_integration:7.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "900D10B0-B47B-46B0-A0A9-8E41660429DD"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_process_integration:7.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D57CEB9D-5C06-4B3E-A36E-5B8689CA5657"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_process_integration:7.30:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3062CE84-B6E2-40DE-B7B1-0752FC21BFAD"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_process_integration:7.31:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "587D81FB-B2ED-4184-9258-A38A18B36DC5"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_process_integration:7.40:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A325699D-6AB0-4BBC-A21C-A974FA1612DE"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_process_integration:7.50:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A3A3226-28D1-4B43-942B-F41BD340E746"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}