« Volver al listado

CVE-2019-0393

Estado: ModificadaMedia (4.3)—

An SQL Injection vulnerability in SAP Quality Management (corrected in S4CORE versions 1.0, 1.01, 1.02, 1.03) allows an attacker to carry out targeted database queries that can read individual fields of historical inspection results.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Quality Management

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-0393",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP Quality Management (S4CORE)",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.0"
            },
            {
              "status": "affected",
              "version": "< 1.01"
            },
            {
              "status": "affected",
              "version": "< 1.02"
            },
            {
              "status": "affected",
              "version": "< 1.03"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-11-13T22:15:11.850",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/2816035",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2816035",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An SQL Injection vulnerability in SAP Quality Management (corrected in S4CORE versions 1.0, 1.01, 1.02, 1.03) allows an attacker to carry out targeted database queries that can read individual fields of historical inspection results."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección SQL en SAP Quality Management (corregida en S4CORE versiones 1.0, 1.01, 1.02, 1.03), permite a un atacante realizar consultas de bases de datos específicas que pueden leer campos individuales de resultados de inspecciones históricas."
    }
  ],
  "lastModified": "2026-06-17T02:08:18.030",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:quality_management:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0600F296-CF2A-488C-A09B-1EDC66AFA115"
            },
            {
              "criteria": "cpe:2.3:a:sap:quality_management:1.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A901E9B0-A2A3-4F05-AFE4-BB4749A4EEE4"
            },
            {
              "criteria": "cpe:2.3:a:sap:quality_management:1.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71BF779F-8AE4-4C69-994B-0647E0115E2F"
            },
            {
              "criteria": "cpe:2.3:a:sap:quality_management:1.03:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB2C1783-4E5B-4FD0-94C5-B1093BF6C594"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}