« Volver al listado

CVE-2019-0311

Estado: ModificadaMedia (6.1)—

El portal de concesionarios automotrices en la aplicación SAP R / 3 Enterprise (versiones: 600, 602, 603, 604, 605, 606, 616, 617) no codifica suficientemente las entradas controladas por el usuario, lo que hace posible que un atacante envíe guiones no deseados a el navegador de la víctima utiliza información no deseada y ejecuta código malicioso allí, lo que da como resultado una vulnerabilidad de secuencias de comandos entre sitios (XSS).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — R/3 Enterprise

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-0311",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP R/3 Enterprise Application",
          "versions": [
            {
              "status": "affected",
              "version": "< 6.0"
            },
            {
              "status": "affected",
              "version": "< 6.02"
            },
            {
              "status": "affected",
              "version": "< 6.03"
            },
            {
              "status": "affected",
              "version": "< 6.04"
            },
            {
              "status": "affected",
              "version": "< 6.05"
            },
            {
              "status": "affected",
              "version": "< 6.06"
            },
            {
              "status": "affected",
              "version": "< 6.16"
            },
            {
              "status": "affected",
              "version": "< 6.17"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-06-12T17:29:03.560",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/2728153",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2728153",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Automotive Dealer Portal in SAP R/3 Enterprise Application (versions: 600, 602, 603, 604, 605, 606, 616, 617) does not sufficiently encode user-controlled inputs, this makes it possible for an attacker to send unwanted scripts to the browser of the victim using unwanted input and execute malicious code there, resulting in Cross-Site Scripting (XSS) vulnerability."
    },
    {
      "lang": "es",
      "value": "El portal de concesionarios automotrices en la aplicación SAP R / 3 Enterprise (versiones: 600, 602, 603, 604, 605, 606, 616, 617) no codifica suficientemente las entradas controladas por el usuario, lo que hace posible que un atacante envíe guiones no deseados a el navegador de la víctima utiliza información no deseada y ejecuta código malicioso allí, lo que da como resultado una vulnerabilidad de secuencias de comandos entre sitios (XSS)."
    }
  ],
  "lastModified": "2026-06-17T02:08:09.617",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:r\\/3_enterprise:600:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "922E4FDE-083F-41BB-A4FC-984DF3130204"
            },
            {
              "criteria": "cpe:2.3:a:sap:r\\/3_enterprise:602:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C92B1A0-8813-43EF-A38E-B6481DEFD7B7"
            },
            {
              "criteria": "cpe:2.3:a:sap:r\\/3_enterprise:603:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "23D6F6DB-ED96-4CF1-ADC5-EC46FAD53632"
            },
            {
              "criteria": "cpe:2.3:a:sap:r\\/3_enterprise:604:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9DE3F1EC-B7A0-4044-8838-F9F7E42BD71A"
            },
            {
              "criteria": "cpe:2.3:a:sap:r\\/3_enterprise:605:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A93165A-1CDA-406A-BD47-15D4FDB344B1"
            },
            {
              "criteria": "cpe:2.3:a:sap:r\\/3_enterprise:606:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FD16702-44C1-4D3D-AEEF-E9E8C4E2DC2D"
            },
            {
              "criteria": "cpe:2.3:a:sap:r\\/3_enterprise:616:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA011880-EB61-495E-A7FA-D125E321CA63"
            },
            {
              "criteria": "cpe:2.3:a:sap:r\\/3_enterprise:617:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "960DEA09-0784-412E-9EF4-CF58C7731A31"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}