CVE-2019-0248 - OpenCVE

Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker to access information which would otherwise be restricted.

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:M/Au:N/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Sap	Basis Netweaver

Configuration 1 [-]

OR	cpe:2.3:a:sap:netweaver:7.5:::::::*
	cpe:2.3:a:sap:netweaver:7.51:::::::*
	cpe:2.3:a:sap:netweaver:7.52:::::::*
	cpe:2.3:a:sap:netweaver:7.53:::::::*

Configuration 2 [-]

cpe:2.3:a:sap:basis:7.5:*:*:*:*:*:*:*

References

Link	Resource
http://www.securityfocus.com/bid/106471	Third Party Advisory VDB Entry
https://launchpad.support.sap.com/#/notes/2723142	Permissions Required Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: sap

Published: 2019-01-08T20:00:00

Updated: 2019-01-09T10:57:01

Reserved: 2018-11-26T00:00:00

Link: CVE-2019-0248

JSON object: View

NVD Information

Status : Analyzed

Published: 2019-01-08T20:29:00.970

Modified: 2021-09-13T12:23:04.880

Link: CVE-2019-0248

JSON object: View

Redhat Information

No data.

CWE

NVD-CWE-noinfo

{"containers": {"cna": {"affected": [{"product": "SAP Gateway of ABAP Application Server(SAP_GWFND)", "vendor": "SAP SE", "versions": [{"status": "affected", "version": "< 7.5"}, {"status": "affected", "version": "< 7.51"}, {"status": "affected", "version": "< 7.52"}, {"status": "affected", "version": "< 7.53"}]}, {"product": "SAP Gateway of ABAP Application Server(SAP_BASIS)", "vendor": "SAP SE", "versions": [{"status": "affected", "version": "< 7.5"}]}], "datePublic": "2019-01-08T00:00:00", "descriptions": [{"lang": "en", "value": "Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker to access information which would otherwise be restricted."}], "problemTypes": [{"descriptions": [{"description": "Information Disclosure", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-01-09T10:57:01", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap"}, "references": [{"name": "106471", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/106471"}, {"tags": ["x_refsource_MISC"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985"}, {"tags": ["x_refsource_MISC"], "url": "https://launchpad.support.sap.com/#/notes/2723142"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cna@sap.com", "ID": "CVE-2019-0248", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SAP Gateway of ABAP Application Server(SAP_GWFND)", "version": {"version_data": [{"version_name": "<", "version_value": "7.5"}, {"version_name": "<", "version_value": "7.51"}, {"version_name": "<", "version_value": "7.52"}, {"version_name": "<", "version_value": "7.53"}]}}, {"product_name": "SAP Gateway of ABAP Application Server(SAP_BASIS)", "version": {"version_data": [{"version_name": "<", "version_value": "7.5"}]}}]}, "vendor_name": "SAP SE"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker to access information which would otherwise be restricted."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Information Disclosure"}]}]}, "references": {"reference_data": [{"name": "106471", "refsource": "BID", "url": "http://www.securityfocus.com/bid/106471"}, {"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985", "refsource": "MISC", "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985"}, {"name": "https://launchpad.support.sap.com/#/notes/2723142", "refsource": "MISC", "url": "https://launchpad.support.sap.com/#/notes/2723142"}]}}}}, "cveMetadata": {"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2019-0248", "datePublished": "2019-01-08T20:00:00", "dateReserved": "2018-11-26T00:00:00", "dateUpdated": "2019-01-09T10:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:netweaver:7.5:*:*:*:*:*:*:*", "matchCriteriaId": "74F7C92A-48F7-456A-BDFF-91A482DE8546", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver:7.51:*:*:*:*:*:*:*", "matchCriteriaId": "8476AA24-8DB6-4BE2-A8F9-BFE26D2ECD6E", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver:7.52:*:*:*:*:*:*:*", "matchCriteriaId": "72685658-D774-4E09-B963-EFB626779947", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver:7.53:*:*:*:*:*:*:*", "matchCriteriaId": "77CA44BC-8650-4A20-A359-0FE568E1B345", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:basis:7.5:*:*:*:*:*:*:*", "matchCriteriaId": "E1AD0A9B-B8C0-495A-A792-591E0B12E5F2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker to access information which would otherwise be restricted."}, {"lang": "es", "value": "Bajo ciertas condiciones, SAP Gateway of ABAP Application Server (solucionado en SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) permite que un atacante acceda a informaci\u00f3n que normalmente estar\u00eda restringida."}], "id": "CVE-2019-0248", "lastModified": "2021-09-13T12:23:04.880", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-01-08T20:29:00.970", "references": [{"source": "cna@sap.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/106471"}, {"source": "cna@sap.com", "tags": ["Permissions Required", "Vendor Advisory"], "url": "https://launchpad.support.sap.com/#/notes/2723142"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}