« Volver al listado

CVE-2019-0338

Estado: ModificadaMedia (5.3)—

During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and pragma were not properly set, allowing an attacker to access restricted information, resulting in Information Disclosure.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Gateway

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-0338",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP Gateway",
          "versions": [
            {
              "status": "affected",
              "version": "< 750"
            },
            {
              "status": "affected",
              "version": "< 751"
            },
            {
              "status": "affected",
              "version": "< 752"
            },
            {
              "status": "affected",
              "version": "< 753"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-08-14T14:15:16.167",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/2793351",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2793351",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and pragma were not properly set, allowing an attacker to access restricted information, resulting in Information Disclosure."
    },
    {
      "lang": "es",
      "value": "Durante una petición V2/V4 OData en SAP Gateway, versiones 750, 751, 752, 753, los atributos de Encabezado HTTP controlados por caché y pragma no se ajustaron correctamente, lo que permite a un atacante acceder a información restringida, resultando en la Divulgación de Información."
    }
  ],
  "lastModified": "2026-06-17T02:08:12.040",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:gateway:750:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE48FA0B-81A3-4266-B82F-F82E7631C7AA"
            },
            {
              "criteria": "cpe:2.3:a:sap:gateway:751:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7290C61F-19FF-42CD-8109-56D5BA1351EE"
            },
            {
              "criteria": "cpe:2.3:a:sap:gateway:752:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7F41777-93EE-4E71-A268-74041EFAEF64"
            },
            {
              "criteria": "cpe:2.3:a:sap:gateway:753:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BFCE57CC-9214-495A-B03A-04EAA308D589"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}